DVA-C02 Development with AWS Services Practice Test 26 — 15 Questions

Question 1

A developer wants to deploy a containerized application to Amazon ECS using Fargate. The application requires persistent storage that can be shared across multiple containers in the same task. Which storage option should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon EFS file system. Amazon EFS provides a shared, persistent, and scalable file system that can be mounted by multiple containers within the same ECS task using Fargate. EFS supports the Network File System (NFS) protocol, allowing concurrent read/write access from all containers in the task, which meets the requirement for shared persistent storage. Unlike ephemeral or block storage options, EFS is designed for multi-attach scenarios and persists independently of the container lifecycle.

Answer

Amazon EC2 instance store

Answer

Amazon S3 bucket

Answer

Amazon EBS volume

Question 2

A developer is using Amazon API Gateway to create a REST API. The API must support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. What must the developer do to enable CORS?

Accepted Answer

Enable CORS in the API Gateway settings and configure the required headers.. Enabling CORS in API Gateway requires explicit configuration: you must enable CORS on the API Gateway resource, which automatically generates an OPTIONS method and adds the necessary CORS headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to responses. This is done through the API Gateway console or API configuration, not by the backend Lambda function or CloudFront.

Answer

Use Amazon CloudFront to proxy the API and add CORS headers.

Answer

Nothing; API Gateway automatically handles CORS.

Answer

Add CORS headers in the Lambda function code.

Question 3

A company is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function processes user uploads from Amazon S3 and stores metadata in DynamoDB. The function is experiencing high latency during peak hours. Which action would MOST improve the performance without increasing the function timeout?

Accepted Answer

Increase the DynamoDB table's provisioned read and write capacity.. Increasing the DynamoDB table's provisioned read and write capacity directly addresses the root cause of high latency during peak hours: throttling due to insufficient throughput. When the Lambda function's write requests exceed the table's capacity, DynamoDB throttles them, causing retries and increased latency. Raising the capacity allows DynamoDB to handle the burst of metadata writes without throttling, reducing response times without requiring a longer function timeout.

Answer

Increase the Lambda reserved concurrency.

Answer

Move the Lambda function into a VPC with a DynamoDB VPC endpoint.

Answer

Enable DynamoDB Accelerator (DAX) for the table.

Question 4

A developer needs to store temporary session data for a web application running on Amazon EC2 behind an Application Load Balancer. The data must be accessible across multiple EC2 instances. Which AWS service should the developer use?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service (e.g., Redis or Memcached) that can store temporary session data with sub-millisecond latency. Since the data must be accessible across multiple EC2 instances behind an Application Load Balancer, ElastiCache offers a centralized, highly available data store that all instances can read from and write to, ensuring session persistence regardless of which instance handles a request.

Answer

Amazon EBS

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 5

A company runs a containerized web application on Amazon ECS using Fargate. The application needs to store files in Amazon S3. The developer wants to follow the principle of least privilege for the ECS task IAM role. Which IAM policy should be attached to the task role?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}]}. It grants only the s3:PutObject action on the specific S3 bucket, which is the minimum permission required for the application to store files. This adheres to the principle of least privilege by not including unnecessary read or list actions. The task role should be scoped to the exact resource and action needed.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::example-bucket/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:PutObject"],"Resource":"arn:aws:s3:::example-bucket/*"}]}

Question 6

A developer is writing an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message at least once, but duplicates are acceptable. The function is triggered by a Lambda event source mapping. If the function returns an error, what happens to the message?

Accepted Answer

The message remains in the queue and becomes visible after the visibility timeout expires.. When a Lambda function invoked by an SQS event source mapping returns an error, the message is not deleted from the queue. Instead, it remains in the queue and becomes visible again after the visibility timeout expires. This allows the function to retry processing the message, ensuring at-least-once processing. The default behavior is to retry based on the queue's redrive policy, not to immediately send the message to a DLQ or delete it.

Answer

The message is sent to a dead-letter queue (DLQ).

Answer

The message is deleted from the queue to prevent duplicate processing.

Answer

Lambda automatically retries the function with a 1-minute delay.

Question 7

A developer is using AWS Step Functions to orchestrate a workflow that includes a Lambda function for data transformation. The Lambda function occasionally times out after 15 seconds. The Step Function execution fails with a 'States.Timeout' error. The developer wants to retry the Lambda task up to 3 times with exponential backoff. Which configuration should the developer add to the state definition in the Amazon States Language (ASL)?

Accepted Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]. It defines a retry policy for the 'States.Timeout' error, which is the error that occurs when the Lambda function times out. The configuration sets a 1-second initial interval, doubles the interval on each retry (BackoffRate of 2), and allows up to 3 retries, matching the requirement exactly.

Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 2, "BackoffRate": 3, "MaxAttempts": 5 } ]

Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 2 } ]

Answer

"Retry": [ { "ErrorEquals": ["Lambda.ServiceException"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]

Question 8

A company uses Amazon API Gateway to expose a REST API. The API uses a Lambda authorizer to validate JWT tokens. Recently, the API has been returning 401 Unauthorized errors for valid tokens. The developer notices that the tokens are signed with a new key but the authorizer still uses the old key. What is the MOST efficient way to update the authorizer with the new key?

Accepted Answer

Modify the Lambda authorizer to fetch the public key from a well-known URL at runtime.. Fetching the public key from a well-known URL (e.g., the JWKS endpoint) at runtime allows the Lambda authorizer to automatically use the latest signing key without manual intervention. This approach decouples key rotation from the authorizer code, ensuring that valid tokens signed with the new key are accepted immediately. It is the most efficient method as it avoids redeployments, environment variable updates, or recreating the authorizer.

Answer

Update the API Gateway stage deployment to redeploy the API.

Answer

Delete and recreate the API Gateway authorizer with the new key.

Answer

Update the Lambda authorizer's environment variable with the new key and publish a new version.

Question 9

A developer needs to send large files (up to 5 GB) from a web application to Amazon S3. The application runs on EC2 instances. Which approach is MOST efficient and reliable?

Accepted Answer

Use S3 multipart upload to upload the file in parts.. S3 multipart upload is the most efficient and reliable approach for uploading large files (up to 5 GB) because it allows the file to be split into smaller parts that can be uploaded in parallel, improving throughput and resilience. If a part fails, only that part needs to be retried, not the entire file, and the upload can be paused and resumed. This is the recommended AWS method for objects larger than 100 MB and is required for objects over 5 GB.

Answer

Save the file to EC2 instance store and then copy to S3.

Answer

Upload the file as a single S3 PutObject operation.

Answer

Use S3 Transfer Acceleration to upload the file.

Question 10

Which TWO IAM policy conditions can be used to enforce multi-factor authentication (MFA) for API calls?

Accepted Answer

Condition: { "Null": { "aws:MultiFactorAuthPresent": "false" } }. The `Null` condition operator checks whether the `aws:MultiFactorAuthPresent` key is absent or explicitly set to `false`. When set to `false`, it denies API calls that were made without MFA, effectively enforcing MFA for all API operations. Option E is correct because the `Bool` condition operator with `true` requires that MFA was used, but it must be combined with a `Deny` effect to block unauthenticated requests; used alone in an `Allow` statement, it only permits MFA-authenticated calls without blocking non-MFA ones.

Answer

Condition: { "StringLike": { "iam:MFADeviceType": "Virtual" } }

Answer

Condition: { "ForAllValues:StringEquals": { "aws:SourceIdentity": "admin" } }

Answer

Condition: { "StringEquals": { "iam:ResourcePath": "/" } }

Question 11

A developer needs to store configuration parameters securely for a Lambda function. The parameters include database credentials and API keys. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and managing sensitive configuration parameters such as database credentials and API keys throughout their lifecycle. It offers automatic rotation of secrets with built-in integration for Amazon RDS, Redshift, and DocumentDB, and enforces fine-grained access control via IAM policies. This makes it the most suitable service for the developer's requirement of securely storing and managing database credentials and API keys for a Lambda function.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Question 12

A company is using Amazon API Gateway to expose a REST API. The API must authenticate requests using an external OAuth 2.0 provider. Which API Gateway feature should be used?

Accepted Answer

Lambda authorizer. A Lambda authorizer (formerly known as a custom authorizer) allows you to implement custom authentication logic using an external OAuth 2.0 provider. The Lambda function receives the OAuth 2.0 bearer token from the request, validates it against the external provider's token introspection endpoint or by verifying the JWT signature, and returns an IAM policy that grants or denies access to the API Gateway method.

Answer

IAM authorization

Answer

Resource policy

Answer

Amazon Cognito User Pools

Question 13

A developer is building an application that needs to send email notifications to users. Which AWS service is designed for sending transactional emails?

Accepted Answer

Amazon Simple Email Service (SES). Amazon Simple Email Service (SES) is specifically designed for sending transactional emails, such as order confirmations, password resets, and marketing communications. It provides a reliable, scalable SMTP interface or API to send high-deliverability emails, with features like dedicated IP addresses and feedback loops. This makes it the correct choice for an application that needs to send email notifications directly to users.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Simple Queue Service (SQS)

Question 14

A developer is using AWS CodeBuild to build a Java application. The build fails with 'OutOfMemoryError: Java heap space'. How can the developer fix this without changing the source code?

Accepted Answer

Increase the compute type of the build project. AWS CodeBuild allows you to increase the compute type (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM or LARGE), which provides more memory and CPU resources. This directly addresses the 'OutOfMemoryError: Java heap space' by giving the JVM more physical memory to work with, without requiring any source code changes.

Answer

Add -Xmx1024m to the buildspec commands

Answer

Change the build image to a smaller one

Answer

Set the memory parameter in the build project

Question 15

A developer wants to debug an AWS Lambda function by viewing real-time logs. Which AWS service should the developer use?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because AWS Lambda automatically streams all execution logs, including real-time output from console.log() statements and any errors, to CloudWatch Logs. The developer can use the CloudWatch Logs console or the `aws logs tail` command to view these logs in near real-time, enabling effective debugging of function behavior as it executes.

Answer

AWS X-Ray

Answer

Amazon S3

Answer

AWS CloudTrail