DVA-C02 Development with AWS Services Practice Test 26 — 15 Questions

Question 1

A developer is creating an AWS Lambda function that processes files uploaded to an S3 bucket. The developer wants to invoke the Lambda function automatically when a new file is uploaded. Which approach should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure S3 event notifications to invoke the Lambda function directly.. S3 can directly invoke a Lambda function via S3 event notifications. When a new object is created in the bucket, S3 publishes a notification with the event type `s3:ObjectCreated:*` and the Lambda function is triggered asynchronously. This is the simplest and most direct integration for this use case, requiring no intermediate services.

Answer

Use Amazon API Gateway to expose an endpoint and have S3 call it.

Answer

Configure S3 to send events to an SQS queue, and configure Lambda to poll the queue.

Answer

Use Amazon CloudWatch Events to trigger Lambda on S3 PUT events.

Question 2

A developer is working on a serverless application that uses Amazon DynamoDB as the database. The application reads and writes data to a DynamoDB table named 'Orders'. The table has a partition key 'OrderID' and a sort key 'OrderDate'. The application experiences high read latency during peak hours. The developer checks the CloudWatch metrics and notices high ReadThrottleEvents for the table. The table's read capacity is set to on-demand mode. The developer also notices that the application performs many queries that scan the entire table to find orders by customer ID, which is not a key attribute. What should the developer do to reduce read throttling?

Accepted Answer

Create a Global Secondary Index (GSI) on the CustomerID attribute and query the index instead of scanning the table.. The correct option is C: create a Global Secondary Index (GSI) on the CustomerID attribute and query the index instead of scanning the table. The application's high ReadThrottleEvents stem from full-table Scan operations to find orders by a non-key attribute, and a GSI with CustomerID as its partition key lets those lookups use efficient Query operations that read only the matching items, drastically reducing consumed read capacity. Because the table is in on-demand mode, throttling is caused by the sheer volume of scanned data rather than a fixed capacity ceiling, so the GSI directly addresses the root cause. Option A (DAX) only caches reads and does not fix the inefficient Scan access pattern, and it cannot help with the underlying non-key lookup design. Option B is unnecessary because on-demand mode already scales automatically, and switching to provisioned capacity does not eliminate the wasteful Scans. Option D is invalid because on-demand tables have no user-configurable maximum read capacity limit to increase.

Answer

Enable DynamoDB Accelerator (DAX) to cache the read results.

Answer

Switch the table to provisioned capacity mode and increase the read capacity units.

Answer

Keep the table in on-demand mode but increase the maximum read capacity limit.

Question 3

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to create a custom resource that runs a Lambda function during stack creation and update. What must the developer do to ensure the custom resource works correctly?

Accepted Answer

The Lambda function must send a response to an S3 pre-signed URL.. AWS CloudFormation custom resources require the Lambda function to send a response to an S3 pre-signed URL to signal completion. CloudFormation waits for this response to proceed with stack operations; without it, the stack creation or update will time out and fail.

Answer

The Lambda function must be defined in the same CloudFormation template.

Answer

The Lambda function must return a JSON object with the desired output.

Answer

The Lambda function must be written in Python.

Question 4

A company has a legacy application that generates log files on an EC2 instance. The developer needs to stream these log files to Amazon CloudWatch Logs in real time. The developer installed the CloudWatch agent on the EC2 instance and configured it to monitor the log files. However, the logs are not appearing in CloudWatch Logs. The developer checks the agent status and sees that the agent is running. What is the most likely cause of this issue?

Accepted Answer

The EC2 instance does not have an IAM role with the necessary CloudWatch Logs permissions.. The CloudWatch agent uses the EC2 instance's IAM role credentials to call the CloudWatch Logs API (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents). If the instance profile lacks these permissions, the agent process runs but every API call is rejected with AccessDenied, so logs never appear. This is the most common cause when the agent status shows running but no data arrives.

Answer

The log file format is not compatible with the CloudWatch agent.

Answer

The EC2 instance is in a private subnet without internet access.

Answer

The CloudWatch agent configuration file does not specify an existing log group.

Question 5

A developer is implementing a solution to store application logs from multiple EC2 instances. The logs must be stored in a centralized location for analysis. Which services can the developer use to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it provides a centralized service for collecting, monitoring, and storing log data from EC2 instances. By installing the CloudWatch Logs agent on each EC2 instance, logs are automatically streamed to CloudWatch Logs, where they can be analyzed, searched, and retained for auditing or troubleshooting.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Analytics

Answer

Amazon DynamoDB

Question 6

A developer is using AWS Lambda to process records from an Amazon Kinesis Data Stream. The Lambda function is invoked with a batch of records. The function processes each record and then returns a response. The developer notices that some records are being processed multiple times. The function's execution time is within the Lambda timeout. The Kinesis stream has 10 shards. The developer wants to ensure that each record is processed exactly once. What should the developer do?

Accepted Answer

Modify the Lambda function to use the sequence number of each record to deduplicate processing.. The correct option is B: modify the Lambda function to use the sequence number of each record to deduplicate processing. AWS Lambda's Kinesis event source mapping provides at-least-once delivery, so a batch or individual records can be retried after a failure or timeout, causing duplicates; Kinesis sequence numbers uniquely identify each record within a shard, so the function can track processed sequence numbers (for example in DynamoDB) and skip records already handled. Option A is wrong because reducing shards does not change Lambda's at-least-once semantics and would only lower throughput. Option C is wrong because retry configuration cannot prevent duplicates from Lambda's own retries or checkpointing behavior. Option D is wrong because a larger batch size does not provide exactly-once processing and can actually increase the number of records reprocessed after a failure.

Answer

Reduce the number of shards to minimize the chance of duplicates.

Answer

Configure the Lambda function's error handling to retry only failed records.

Answer

Increase the batch size to process more records per invocation.

Question 7

A developer is designing a serverless application that processes streaming data from IoT devices. The application must be able to handle data from millions of devices and store the data in a durable, scalable data store. Which AWS services should the developer use? (Choose THREE.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time streaming of large volumes of data, such as from millions of IoT devices. It can ingest and store data durably for up to 365 days, making it ideal for the ingestion layer of this serverless application.

Answer

Amazon RDS

Answer

Amazon SQS

Question 8

A developer is building a serverless application using AWS Lambda to process images uploaded to an S3 bucket. The Lambda function needs to resize each image and store the result in another S3 bucket. Which TWO actions should the developer take to ensure the function can access the S3 buckets securely?

Accepted Answer

Create an IAM execution role for the Lambda function with permissions to read from the source bucket and write to the destination bucket.. Lambda functions require an IAM execution role that grants permissions to access other AWS services. By creating a role with policies that allow s3:GetObject on the source bucket and s3:PutObject on the destination bucket, the function can securely read and write images without embedding long-term credentials.

Answer

Store the AWS access key and secret key in the Lambda environment variables.

Answer

Assign an IAM user to the Lambda function and embed the user's access key in the function code.

Answer

Attach an IAM instance profile to the Lambda function.

Question 9

A company uses Amazon API Gateway to expose a REST API backed by AWS Lambda. The API has a resource /items with GET and POST methods. The GET method returns items from a DynamoDB table. The POST method adds an item to the table. Currently, all methods are open to the public. Security requirements mandate that only authenticated users can access the POST method, while the GET method remains public. Which THREE steps should the developer take to meet these requirements?

Accepted Answer

Configure the Lambda authorizer only on the POST method in the API Gateway.. You can configure a Lambda authorizer at the method level in API Gateway, which allows you to selectively secure only the POST method while leaving the GET method public. This meets the requirement of restricting access to authenticated users for POST only, without affecting the public GET endpoint.

Answer

Use an Amazon Cognito User Pools authorizer for the entire API.

Answer

Add a resource policy that denies public access to the POST method.

Question 10

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload a file to s3://my-bucket/confidential/report.pdf. What will happen?

Accepted Answer

The upload fails because the Deny statement overrides the Allow.. IAM policy evaluation logic dictates that an explicit Deny always overrides any Allow. In this scenario, the Deny statement denies `s3:PutObject` on the path `arn:aws:s3:::my-bucket/confidential/*`, which matches the user's upload target `s3://my-bucket/confidential/report.pdf`. Even though the Allow statement grants `s3:PutObject` on `arn:aws:s3:::my-bucket/*`, the explicit Deny takes precedence, causing the upload to fail.

Answer

The upload succeeds because the Deny statement applies only to the bucket, not the user.

Answer

The upload fails because the policy does not allow PutObject on that path.

Answer

The upload succeeds because the Allow statement grants PutObject.

Question 11

A developer is designing a microservices architecture where each service runs in its own Amazon ECS container. Services need to communicate with each other. The developer wants to simplify service discovery and load balancing. Which AWS service should the developer use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that allows microservices to dynamically discover each other using DNS or HTTP API calls. It integrates natively with Amazon ECS, enabling services to register themselves and resolve other services by logical names, which simplifies service discovery and load balancing across containers.

Answer

Elastic Load Balancing

Answer

Amazon ECS service discovery

Answer

Amazon Route 53

Question 12

Refer to the exhibit. A developer invoked a Lambda function and received the response shown. What does the response indicate?

Accepted Answer

The function was invoked but returned an error.. The response includes a 'FunctionError' field with value 'Unhandled' and an 'error' object, indicating that the Lambda function was invoked successfully (StatusCode 200) but the function itself encountered an error during execution. Option A is incorrect because a permissions error would result in a 4xx or 5xx StatusCode, not 200. Option B is incorrect because the function did not execute successfully—it returned an error. Option C is incorrect because a timeout would typically produce a 'null' FunctionError or a specific timeout error, not an explicit error object. Option D is correct: the function was invoked, but it returned an error.

Answer

The function was not invoked due to a permissions error.

Answer

The function executed successfully but did not return any logs.

Answer

The invocation timed out.

Question 13

A company runs a production application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application receives high traffic and needs to process incoming HTTP requests, store the request payload in an S3 bucket for auditing, and return a response. The development team uses AWS Lambda to process the payload. The team wants to ensure that the solution is scalable, fault-tolerant, and decoupled. The current approach is to have the EC2 instances send requests directly to the Lambda function via the AWS SDK. However, the team notices that during traffic spikes, some requests are lost and the Lambda function throttles. What should the team do to improve the architecture?

Accepted Answer

Have the EC2 instances send messages to an Amazon SQS queue, and configure the SQS queue as an event source for the Lambda function.. Using Amazon SQS decouples the EC2 instances from the Lambda function, providing a buffer that absorbs traffic spikes and prevents request loss. The SQS queue acts as an event source for Lambda, allowing the function to process messages at its own pace, reducing throttling. Option A is incorrect because increasing reserved concurrency may reduce throttling but does not buffer requests; if the function is still overwhelmed, requests can be dropped. Option B is incorrect because API Gateway still invokes Lambda synchronously, and throttling can still occur. Option C is incorrect because Kinesis Data Streams is designed for real-time streaming and analytics, not for simple request queuing, and introduces unnecessary complexity.

Answer

Increase the Lambda function's reserved concurrency to the maximum allowed.

Answer

Place API Gateway in front of Lambda and have EC2 send requests to API Gateway.

Answer

Use Amazon Kinesis Data Streams instead of Lambda to process the payload.

Question 14

A developer is building a serverless application that uses AWS Step Functions to orchestrate multiple AWS Lambda functions. The workflow involves three steps: validate input, process data, and store results. The developer notices that the workflow occasionally fails due to transient errors in the process data step. The developer wants to implement error handling so that the workflow retries the process data step up to three times with an exponential backoff. Additionally, if all retries fail, the workflow should send a notification to an Amazon SNS topic and transition to a failure state. The developer has defined the state machine in Amazon States Language (ASL). How should the developer configure the state machine?

Accepted Answer

In the process data state definition, add a Retry field with MaxAttempts: 3 and BackoffRate: 2, and add a Catch field that transitions to a failure state and sends an SNS notification.. In Amazon States Language (ASL), retry and error handling are configured per-state, not at the workflow level. The process data state should include a Retry block with MaxAttempts: 3 and BackoffRate: 2 (which produces exponential backoff: 1s, 2s, 4s by default), and a Catch block that matches the error and transitions to a failure state. The failure state can be a Task state invoking SNS Publish, or the Catch can route to a state that publishes to SNS before ending in a Fail state.

Answer

Write custom retry logic inside the Lambda function code and catch exceptions there.

Answer

Modify the IAM execution role to allow the state machine to call SNS and then use a ResultPath to handle errors.

Answer

Add a Retry field at the workflow level and a Catch field at the workflow level.

Question 15

A company is building a serverless application using AWS Lambda to process user uploads to Amazon S3. The Lambda function needs to access a DynamoDB table to store metadata. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and attach it to the Lambda function.. AWS Lambda uses an IAM role (execution role) to obtain temporary credentials via the AWS Security Token Service (STS). Attaching a policy that grants DynamoDB access to this role follows the principle of least privilege and avoids long-term credentials. This is the standard, secure pattern for granting Lambda functions access to other AWS services.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's ARN.

Answer

Hardcode the DynamoDB credentials in the Lambda function code.