DVA-C02 Development with AWS Services Practice Test 25 — 15 Questions

Question 1

A company is using Amazon API Gateway to expose a set of RESTful APIs. Each API call is processed by an AWS Lambda function. The company wants to enforce throttling limits to prevent abuse. Specifically, the company wants to allow 100 requests per second per API key. What is the SIMPLEST way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a usage plan in API Gateway with a rate limit of 100 requests per second per API key.. API Gateway usage plans are specifically designed to enforce throttling limits per API key. By creating a usage plan with a rate limit of 100 requests per second and associating it with the desired API keys, you can directly control request rates at the API Gateway layer without additional services or custom logic. This is the simplest and most native approach for per-API-key throttling.

Answer

Use AWS WAF to block requests after 100 per second.

Answer

Set a reserved concurrency on the Lambda function to 100.

Answer

Configure a CloudWatch alarm to disable the API key after exceeding the limit.

Question 2

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to update a stack and needs to know what changes will be made before executing the update. Which AWS CLI command should the developer use?

Accepted Answer

aws cloudformation create-change-set. The `aws cloudformation create-change-set` command creates a change set, which is a summary of proposed changes to a CloudFormation stack. This allows the developer to review what resources will be added, modified, or deleted before executing the update, without making any actual changes. The change set can then be executed with `aws cloudformation execute-change-set` to apply the changes.

Answer

aws cloudformation deploy

Answer

aws cloudformation validate-template

Answer

aws cloudformation update-stack

Question 3

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to communicate with a DynamoDB table. The developer creates a VPC with private subnets and configures the ECS service to use those subnets. However, the tasks cannot reach DynamoDB. What is the MOST likely cause?

Accepted Answer

The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.. ECS tasks using the Fargate launch type in private subnets cannot reach public AWS services like DynamoDB unless the VPC has either a NAT gateway (to route traffic through an internet gateway) or a VPC endpoint for DynamoDB. Without one of these, the private subnets have no route to the DynamoDB API endpoints, causing connectivity failures. The IAM role and security group are configured correctly, but the network path is missing.

Answer

The task IAM role does not have permissions to access DynamoDB.

Answer

The security group of the tasks does not allow outbound traffic to DynamoDB.

Answer

The task definition does not have a network mode that supports DynamoDB.

Question 4

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer wants to identify the specific error on a failed instance. Which AWS CLI command should the developer use?

Accepted Answer

aws deploy get-deployment-instance. The `aws deploy get-deployment-instance` command retrieves detailed information about a single instance in a deployment group, including the specific error messages and lifecycle event logs that caused the instance to fail. This allows the developer to diagnose the root cause of the failure on a particular instance, which is exactly what is needed when the overall deployment fails with a generic error message.

Answer

aws deploy get-deployment

Answer

aws deploy list-deployments

Answer

aws deploy list-deployment-instances

Question 5

A developer is using AWS Lambda to process messages from an Amazon SQS queue. The function needs to access an Amazon DynamoDB table. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Assign an IAM role to the Lambda function with a policy that grants the required DynamoDB permissions.. AWS Lambda uses an IAM execution role to securely obtain temporary credentials via the AWS Security Token Service (STS). By attaching a policy that grants only the required DynamoDB actions (e.g., GetItem, PutItem) on specific tables, you follow the principle of least privilege. This avoids hardcoding long-term credentials and eliminates the risk of credential exposure.

Answer

Use the Lambda function's execution role to grant full administrative access to DynamoDB.

Answer

Store the AWS access key and secret access key as environment variables in the Lambda function.

Answer

Create an IAM user with DynamoDB access and use its credentials in the Lambda function.

Question 6

A development team is using AWS CodeBuild to compile and test their code. They want to store build artifacts in an Amazon S3 bucket. The buildspec.yml file includes an artifacts section. Which configuration correctly specifies the output artifacts?

Accepted Answer

artifacts:
  files:
    - '**/*'
  discard-paths: no. It uses the correct `files` key with a glob pattern `'**/*'` to include all files, and `discard-paths: no` preserves the directory structure in the S3 bucket. In CodeBuild, the `artifacts` section requires `files` (not `file` or `path`) to specify which files to output, and `discard-paths` controls whether the relative path is kept.

Answer

artifacts:
  base-directory: 'build'
  files: '**/*'

Answer

artifacts:
  file: '**/*'
  discard-paths: no

Answer

artifacts:
  path: '**/*'
  discard-paths: false

Question 7

A developer is troubleshooting a Lambda function that times out when processing large files from Amazon S3. The function is configured with a 3-minute timeout and 128 MB memory. Which TWO actions would MOST likely resolve the issue? (Choose TWO.)

Accepted Answer

Increase the memory allocation for the Lambda function.. Increasing the memory allocation for a Lambda function also increases CPU and network bandwidth, which can significantly speed up the processing of large files, helping the function complete within the timeout. Option E is correct because increasing the Lambda function timeout directly addresses the timeout issue, giving the function more time to complete processing large files. Option A is incorrect because S3 multipart upload is used for uploading large objects to S3, not for downloading/reading from S3; it does not improve data ingestion into a Lambda function. Option C is incorrect because sending events to SQS does not affect the processing speed of a single large file; it only decouples the event source. Option D is too generic; while a more efficient algorithm could help, it is not a guaranteed or most likely fix compared to increasing memory or timeout.

Answer

Use S3 multipart upload for large files to improve throughput.

Answer

Change the S3 event notification to send messages to an Amazon SQS queue instead.

Answer

Update the Lambda function code to use a more efficient algorithm.

Question 8

An S3 bucket has versioning enabled with MFA Delete. A developer tries to permanently delete a specific version of an object using the AWS CLI without providing MFA. What is the result?

Accepted Answer

The request is denied with an AccessDenied error.. When MFA Delete is enabled on an S3 bucket, any request to permanently delete an object version must include multi-factor authentication. Without MFA, the AWS CLI request is denied with an AccessDenied error, as S3 enforces this security requirement at the API level. The developer cannot bypass this by omitting the MFA token.

Answer

A delete marker is created for the object version.

Answer

The object version is permanently deleted.

Answer

The object version is marked with a delete marker.

Question 9

A developer creates the CloudFormation stack with the template above. After the stack is created, messages that are not processed after 5 receives are moved to the DLQ. However, the developer notices that the RedrivePolicy references a queue ARN that is hardcoded. What is the best practice to avoid this hardcoded ARN?

Accepted Answer

Use Fn::GetAtt with "Arn" attribute on the DLQ resource.. `Fn::GetAtt` with the `Arn` attribute retrieves the actual Amazon Resource Name (ARN) of the Dead Letter Queue (DLQ) resource dynamically at stack creation time. This avoids hardcoding the ARN, making the template portable across accounts and regions. The RedrivePolicy property requires the full ARN of the DLQ, and `Fn::GetAtt` is the intrinsic function designed to return resource attributes like ARN.

Answer

Use Ref to reference the DLQ's QueueName and construct the ARN.

Answer

Use Fn::Sub to substitute the queue name into a hardcoded ARN template.

Answer

Use Fn::ImportValue to import the DLQ ARN from another stack.

Question 10

A developer is using AWS Elastic Beanstalk to deploy a web application. The application writes logs to the local file system. The developer wants to ensure that logs are automatically rotated and retained for 30 days. What should the developer do?

Accepted Answer

Configure the Elastic Beanstalk environment to enable log rotation and set retention period to 30 days.. Elastic Beanstalk provides a built-in configuration for log rotation and retention directly in the environment settings. By enabling log rotation and setting the retention period to 30 days, the developer can automatically manage logs without modifying application code or adding external agents. This leverages the Elastic Beanstalk health agent, which handles log rotation on the EC2 instances and stores rotated logs in Amazon S3 with lifecycle policies to enforce the retention period.

Answer

Modify the application code to write logs directly to an S3 bucket with lifecycle policies.

Answer

Add a cron job to the EC2 instances that compresses and deletes old logs.

Answer

Install the CloudWatch Logs agent on the EC2 instances and configure it to stream logs to CloudWatch Logs with a 30-day retention.

Question 11

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a stage that runs a set of integration tests using AWS CodeBuild. The tests require access to a database running on a private subnet in a VPC. The CodeBuild project is configured to use a managed compute image. How can the CodeBuild project access the database?

Accepted Answer

Configure the CodeBuild project to use a custom VPC with the appropriate subnet and security group.. CodeBuild projects using managed compute images run in an AWS-managed VPC by default, which cannot access resources in a customer VPC. By configuring the CodeBuild project to use a custom VPC with the appropriate subnet and security group, the build environment is launched directly into that VPC, enabling it to reach the database on the private subnet without needing a NAT gateway or internet access.

Answer

Place the CodeBuild project in a public subnet and use a NAT gateway to route traffic to the private subnet.

Answer

Set up a VPC peering connection between the CodeBuild VPC and the database VPC.

Answer

Create a VPC endpoint for the database service and attach it to the CodeBuild project.

Question 12

A developer is using AWS Lambda to process events from an Amazon Kinesis stream. The function has been failing with 'ProvisionedThroughputExceededException' errors when writing to a DynamoDB table. What should the developer do to resolve this issue?

Accepted Answer

Implement retry logic with exponential backoff in the Lambda function.. The 'ProvisionedThroughputExceededException' error indicates that the Lambda function is exceeding the write capacity units (WCUs) provisioned for the DynamoDB table. Implementing retry logic with exponential backoff in the Lambda function allows it to handle throttling gracefully by pausing and retrying failed writes, which is the standard AWS-recommended pattern for managing DynamoDB throttling.

Answer

Decrease the batch size of the Kinesis event source mapping.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the memory allocated to the Lambda function.

Question 13

A developer is building a serverless application using AWS Lambda. The application needs to process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. Which AWS service should the developer use to trigger the Lambda function when new messages arrive in the SQS queue?

Accepted Answer

Configure an SQS event source mapping on the Lambda function.. AWS Lambda supports native SQS event source mappings, which allow Lambda to poll an SQS queue and invoke the function automatically when new messages arrive. This integration handles the polling, batch retrieval, and deletion of messages from the queue, making it the simplest and most efficient way to process SQS messages with Lambda.

Answer

Set up an Amazon EventBridge rule to capture SQS events and invoke Lambda.

Answer

Use Amazon SNS to subscribe to the SQS queue and trigger Lambda.

Answer

Use AWS Step Functions to poll the SQS queue and invoke Lambda.

Question 14

A developer is deploying a new version of an AWS Lambda function. The function uses an environment variable for a database password. The developer wants to securely store the password and automatically rotate it. Which combination of AWS services should the developer use?

Accepted Answer

Store the password in AWS Secrets Manager and retrieve it in the Lambda function using the AWS SDK.. AWS Secrets Manager is specifically designed to securely store secrets like database passwords, supports automatic rotation of secrets, and integrates with Lambda via the AWS SDK to retrieve the secret at runtime. This ensures the password is never hardcoded or exposed in environment variables, and rotation can be scheduled without code changes.

Answer

Use AWS KMS to generate a data key and store it in the Lambda environment variable.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it in the Lambda function.

Answer

Encrypt the password using AWS KMS and store it in Amazon DynamoDB.

Question 15

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The command succeeds, but the function returns an error. The developer wants to see the error message and logs from the function execution. What should the developer add to the command?

Accepted Answer

--log-type Tail. The `--log-type Tail` parameter instructs the AWS CLI to retrieve the last 4 KB of log data from the function's execution and base64-encode it in the response. This allows the developer to see the error message and logs directly without needing to query CloudWatch Logs separately. The command must also use `--invocation-type RequestResponse` (the default) to get a synchronous response containing the logs.

Answer

--client-context string

Answer

--qualifier alias

Answer

--invocation-type Event