DVA-C02 Development with AWS Services Practice Test 25 — 15 Questions

Question 1

A developer is using AWS Secrets Manager to rotate database credentials. The rotation Lambda function fails with an error. Which THREE steps should the developer take to troubleshoot? (Choose THREE.)

Accepted Answer

Verify that the Lambda function has network access to the database.. The Lambda function must have network access to the database to perform the rotation (e.g., connecting to the database to change the password). Without network connectivity, the rotation cannot complete. Option D is correct because the Lambda function's IAM role needs permission to call `secretsmanager:PutSecretValue` and `secretsmanager:GetSecretValue` to update the secret in Secrets Manager. Option E is correct because CloudWatch Logs capture the Lambda function's execution output, including any error messages, stack traces, or logs from the rotation logic, which are essential for diagnosing failures.

Answer

Check VPC Flow Logs for the Lambda function's ENI.

Answer

Ensure the KMS key used to encrypt the secret is rotated.

Question 2

A company has a production application running on AWS Lambda that processes real-time streaming data from Amazon Kinesis Data Streams. The Lambda function is configured with a batch size of 100 and a maximum concurrency of 5. Recently, the application has been experiencing failures with a high number of invocation errors. The errors indicate that the function is timing out. The developer checks the CloudWatch metrics and notices that the IteratorAge metric for the Kinesis stream is increasing rapidly, and there are many Throttles events for the Lambda function. The average execution duration of the function is 30 seconds, and the function timeout is set to 1 minute. The Kinesis stream has 10 shards. The company expects the data volume to double in the next month. Which combination of actions should the developer take to resolve the issue and prepare for future growth?

Accepted Answer

Increase Lambda concurrency to at least 20 and reduce the batch size to 10.. The Lambda function is throttled because the maximum concurrency of 5 is too low for 10 shards. With a batch size of 100 and average duration of 30 seconds, each batch takes too long, leading to timeouts and increasing IteratorAge. Increasing concurrency to at least 20 (2 per shard) allows processing of all shards in parallel. Reducing batch size to 10 reduces the processing time per batch, helping avoid timeouts. Option A is wrong because increasing shards without increasing concurrency would worsen throttling. Option C is wrong because disabling reserved concurrency could lead to uncontrolled scaling, but the main issue is concurrency and batch size; also decreasing batch size to 5 may be too small and inefficient. Option D is wrong because increasing timeout and batch size would not resolve throttling and would increase latency.

Answer

Increase the number of shards in the Kinesis stream to 20 and increase Lambda concurrency to 10.

Answer

Disable the reserved concurrency limit on the Lambda function and decrease the batch size to 5.

Answer

Increase the Lambda function timeout to 5 minutes and increase the batch size to 500.

Question 3

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses an Amazon RDS MySQL database. The developer wants to ensure that database credentials are not stored in the application code or environment variables. The solution must automatically rotate credentials every 90 days. The developer has created a secret in AWS Secrets Manager containing the database credentials. The Elastic Beanstalk environment is configured with an IAM instance profile that has permission to read the secret. However, when the application is deployed, it fails to connect to the database. The developer checks the application logs and sees a 'Host not found' error. The RDS instance is in a private subnet, and the Elastic Beanstalk environment is in the same VPC. What is the MOST likely cause of the connection failure?

Accepted Answer

The application code is not retrieving the secret from Secrets Manager at startup.. The correct option is B: the application code is not retrieving the secret from Secrets Manager at startup. Since the credentials are no longer in code or environment variables, the app must call the Secrets Manager API (e.g., GetSecretValue) at runtime to obtain the DB host, username, and password; if it never does so, it has no host to resolve, producing the 'Host not found' error. Option A is wrong because environment properties are explicitly not used for credentials here, and the failure is a missing hostname, not a misreferenced property. Option C is wrong because the instance profile already has read permission to the secret, so an access-denied error would occur instead. Option D is wrong because a cross-region secret would cause an access/not-found error for the secret, not a 'Host not found' database connection error.

Answer

The secret is not correctly referenced in the Elastic Beanstalk environment properties.

Answer

The IAM instance profile does not have the necessary permissions to access the secret.

Answer

The secret is stored in a different region than the Elastic Beanstalk environment.

Question 4

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function sometimes fails to process a message due to a transient error. The company wants to automatically retry failed messages up to 3 times, with a 5-minute delay between retries. What should the company configure?

Accepted Answer

Configure the SQS queue with a delivery delay of 5 minutes and a redrive policy to move messages to a dead-letter queue after 3 receives.. For an SQS-triggered Lambda, retries are managed by SQS. To retry a failed message up to 3 times with a 5-minute delay between attempts, set the queue's visibility timeout to 5 minutes and configure a redrive policy with maxReceiveCount = 3 so the message is moved to a dead-letter queue after 3 failed receives. Note that a delivery delay only postpones the initial delivery of a message and does not create a delay between retries, so option D's 'delivery delay' is the wrong mechanism. Option A is incorrect because Lambda functions do not have a redrive policy; retries for SQS-triggered Lambda are managed by SQS. Option B is unnecessary overhead. Option C is invalid because reserved concurrency and a 'Retry attempts' setting do not control SQS-triggered Lambda retries.

Answer

Configure a dead-letter queue on the Lambda function with a redrive policy that allows up to 3 retries and a 5-minute delay.

Answer

Use AWS Step Functions to poll the SQS queue and implement a retry loop with exponential backoff.

Answer

Set the Lambda function's reserved concurrency to 1 and enable the 'Retry attempts' option to 3 in the function configuration.

Question 5

A developer is building a serverless application using AWS Lambda and Amazon API Gateway REST API. The API Gateway is configured to use a Lambda proxy integration. The developer wants to return a custom error message with a specific HTTP status code (e.g., 404) when a resource is not found. How should the developer implement this?

Accepted Answer

Return a JSON object with keys 'statusCode', 'headers', and 'body' where 'statusCode' is 404 and 'body' contains the error message.. With Lambda proxy integration in API Gateway, the Lambda function must return a response in the exact format that API Gateway expects: a JSON object with 'statusCode' (integer), 'headers' (object), and 'body' (string). This allows the developer to set a custom HTTP status code like 404 and include a custom error message in the body. API Gateway will then map this response directly to the HTTP response sent to the client.

Answer

Return a JSON object with 'status_code' and 'message' keys.

Answer

Throw an exception with a message that includes the HTTP status code.

Answer

Return a JSON object with 'errorMessage' and 'errorType' keys.

Question 6

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application writes to the database using the primary endpoint. The company wants to improve read performance and offload read traffic from the primary instance. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create an Amazon RDS read replica in the same region.. Amazon RDS read replicas are designed to offload read traffic from the primary DB instance. A read replica is an asynchronous copy of the primary that can serve SELECT queries, improving read performance without impacting write operations on the primary. Option C is correct because the application must explicitly use the read replica's endpoint for read queries; the replica does not automatically balance traffic. Together, creating a read replica and modifying the application to direct SELECT queries to its endpoint achieves the goal of improving read performance and offloading the primary.

Answer

Add another primary instance and configure replication.

Answer

Use the Multi-AZ secondary instance endpoint for read queries.

Answer

Enable Amazon RDS Proxy to distribute read queries across instances.

Question 7

A developer is deploying an application on Amazon ECS using Fargate. The application needs to securely access an Amazon RDS database. The developer wants to avoid hardcoding database credentials in the application code. Which THREE actions should the developer take to meet these requirements? (Choose THREE.)

Accepted Answer

Store the database credentials in AWS Systems Manager Parameter Store or AWS Secrets Manager.. AWS Systems Manager Parameter Store and AWS Secrets Manager are AWS-native services designed to securely store and manage sensitive information like database credentials. By storing credentials in these services, the developer avoids hardcoding them in the application code, adhering to security best practices. The application can then retrieve the credentials at runtime using IAM roles and permissions.

Answer

Hardcode the credentials in the application code and encrypt the code using AWS KMS.

Answer

Store the credentials in Amazon Elastic Container Registry (ECR) as a tag.

Question 8

A company is building a serverless application using AWS Lambda. The application processes messages from an Amazon SQS queue. The Lambda function is idempotent and handles duplicate messages correctly. The company needs to ensure that messages are processed in the order they were sent. Which solution should the company use?

Accepted Answer

Configure the Lambda function to poll an SQS FIFO queue with a batch size of 1.. Amazon SQS FIFO queues guarantee first-in, first-out delivery and exactly-once processing, which ensures messages are processed in the order they were sent. By configuring the Lambda function to poll the FIFO queue with a batch size of 1, each message is processed individually, preserving strict ordering without concurrency issues. The Lambda function's idempotency further ensures that any duplicate messages are handled safely, but the FIFO queue's inherent ordering is the key mechanism for maintaining sequence.

Answer

Use Amazon SNS to fan out messages to Lambda.

Answer

Use Amazon Kinesis Data Streams as the event source for Lambda.

Answer

Configure the Lambda function to poll an SQS standard queue with a batch size of 10.

Question 9

A developer is writing an AWS Lambda function that needs to read a secret from AWS Secrets Manager. The function is written in Python. What is the BEST practice for retrieving the secret?

Accepted Answer

Retrieve the secret outside the handler function and cache it in a global variable.. The best practice because retrieving the secret outside the handler function (at initialization time) and caching it in a global variable avoids making a Secrets Manager API call on every invocation. This reduces latency, cost, and the risk of hitting API rate limits. The cached value persists across warm starts within the same execution environment, aligning with AWS Lambda's lifecycle best practices.

Answer

Use AWS Systems Manager Parameter Store to store the secret.

Answer

Retrieve the secret inside the handler function every time it is invoked.

Answer

Store the secret in an environment variable.

Question 10

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. The Lambda authorizer returns an IAM policy that grants access to the API. Recently, the company noticed that some API calls are being throttled due to high latency from the authorizer. What is the MOST effective way to reduce latency?

Accepted Answer

Enable caching for the Lambda authorizer responses.. Enabling caching for the Lambda authorizer responses allows API Gateway to reuse the IAM policy returned by the authorizer for subsequent requests that match the same cache key, without invoking the Lambda function again. This eliminates the latency of the authorizer invocation on cache hits, directly addressing the throttling caused by high authorizer latency.

Answer

Use a custom authorizer instead of a Lambda authorizer.

Answer

Reduce the TTL of the authorizer cache.

Answer

Increase the memory allocated to the Lambda authorizer function.

Question 11

A developer is deploying a web application using AWS Elastic Beanstalk. The application needs to store session state. The developer wants to ensure that session data is not lost if an EC2 instance is terminated. Which solution should the developer implement?

Accepted Answer

Store session data in an Amazon ElastiCache cluster.. Amazon ElastiCache provides a managed, highly available, and durable in-memory cache that can store session state externally from EC2 instances. By using ElastiCache (e.g., Redis with replication and persistence), session data survives instance termination because it is stored in a separate, resilient service, not on the local instance.

Answer

Store session data in an Amazon EBS volume.

Answer

Store session data in an Amazon S3 bucket.

Answer

Store session data in the instance store.

Question 12

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a source stage that uses Amazon S3. The developer updates a file in the S3 bucket, but the pipeline does not start automatically. What is the MOST likely cause?

Accepted Answer

Amazon S3 versioning is not enabled on the bucket.. CodePipeline requires S3 versioning to be enabled on the source bucket to automatically detect changes and start the pipeline. Without versioning, CodePipeline cannot uniquely identify new object versions, so it relies on manual or scheduled polling instead of event-based triggers. Enabling versioning ensures that each PUT operation generates a new version ID, which CodePipeline uses to invoke the pipeline automatically.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The pipeline is configured to use polling instead of event-based triggers.

Answer

AWS CloudTrail is not enabled.

Question 13

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon S3 bucket. The company wants to follow the principle of least privilege. How should the developer provide the necessary permissions?

Accepted Answer

Create an IAM task role with S3 permissions and associate it with the ECS task definition.. Amazon ECS with Fargate launch type uses IAM task roles to grant permissions to containers at the task level. The task role is an IAM role that the ECS task assumes, allowing the application to securely access S3 without hardcoding credentials. This follows the principle of least privilege by scoping permissions to the specific task and using temporary credentials via the AWS STS service.

Answer

Use Amazon EFS to store access keys.

Answer

Assign an IAM instance profile to the Fargate tasks.

Answer

Store AWS credentials in the container image.

Question 14

A developer is using Amazon DynamoDB as the data store for a serverless application. The application experiences high read traffic, and the developer wants to reduce latency. The data is not frequently updated. Which DynamoDB feature should the developer use?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency for DynamoDB tables from single-digit milliseconds to microseconds. Since the data is not frequently updated, DAX can serve repeated read requests from its cache without hitting the underlying table, making it ideal for high-read, low-write workloads.

Answer

DynamoDB Auto Scaling

Answer

DynamoDB Global Tables

Answer

DynamoDB Time to Live (TTL)

Question 15

A company is using AWS CodePipeline to automate the deployment of a web application. The pipeline has three stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The application is deployed to an Auto Scaling group of EC2 instances. Recently, a deployment failed because the CodeDeploy agent on one of the instances was not running. The developer wants to ensure that the CodeDeploy agent is always running on all instances. What is the MOST efficient solution?

Accepted Answer

Modify the Auto Scaling group's launch configuration to include a user data script that installs and starts the CodeDeploy agent.. The correct option is C: modifying the Auto Scaling group's launch configuration to include a user data script that installs and starts the CodeDeploy agent. This is the most efficient solution because user data scripts run automatically on every new EC2 instance at launch, ensuring the CodeDeploy agent is installed and started on all instances without manual intervention or ongoing monitoring. It directly addresses the root cause by making agent installation part of the instance provisioning process. Option A is inefficient because CloudTrail records API activity, not agent process status, and adding Lambda-based remediation is unnecessarily complex. Option B is not viable because CloudWatch cannot natively detect whether a local process like the CodeDeploy agent is running without custom metrics or agents. Option D could work but requires scheduled Run Command executions and doesn't guarantee the agent is present on newly launched instances before deployments occur.

Answer

Use AWS CloudTrail to monitor the CodeDeploy agent status and trigger an AWS Lambda function to restart it.

Answer

Configure a CloudWatch alarm to detect when the CodeDeploy agent is not running and restart it automatically.

Answer

Use AWS Systems Manager Run Command to run a script that checks and restarts the CodeDeploy agent on a schedule.