DVA-C02 Development with AWS Services Practice Test 28 — 15 Questions

Question 1

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The function is currently active and handling traffic. The developer wants to gradually shift traffic to the new version and rollback if errors increase. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the alias to route a percentage of traffic to the new version and the rest to the current version.. Lambda aliases can route traffic. Option A and C are correct. Option B is wrong because weights sum to 100. Option D is wrong because CodeDeploy can manage traffic shifting but not directly via CLI. Option E is wrong because SDK is not needed.

Answer

Invoke the Lambda function with the new version using the AWS SDK.

Answer

Update the alias to route 100% of traffic to the new version.

Answer

Use AWS CodeDeploy to create a deployment group for the Lambda function.

Question 2

A company is using AWS CloudFormation to manage infrastructure. A developer needs to create a stack that will launch an EC2 instance and associate an Elastic IP address. The Elastic IP must be released when the stack is deleted. Which TWO resources should the developer include in the CloudFormation template? (Choose TWO.)

Accepted Answer

AWS::EC2::EIP. AWS::EC2::EIP and AWS::EC2::EIPAssociation are needed. Option B and D are correct. Option A (EC2::Instance) is needed but not part of the pair. Option C (EC2::NetworkInterface) is not required. Option E (EC2::Address) is not a valid resource.

Answer

AWS::EC2::Instance

Answer

AWS::EC2::NetworkInterface

Answer

AWS::EC2::Address

Question 3

A developer is building a REST API using API Gateway and Lambda. The API must be secured using a Lambda authorizer. Which THREE steps are necessary to implement the Lambda authorizer? (Choose THREE.)

Accepted Answer

Configure the API Gateway method to use the Lambda authorizer.. Option A, B, and D are correct. Option C is wrong because API key is not required for Lambda authorizer. Option E is wrong because the authorizer returns an IAM policy, not a token.

Answer

Return a JSON Web Token (JWT) from the authorizer function.

Answer

Generate an API key and distribute it to clients.

Question 4

Refer to the exhibit. A developer attached the IAM policy to a Lambda function's execution role. The function reads items from a DynamoDB table that uses AWS KMS customer managed key (CMK) for encryption at rest. When the function tries to read an item, it receives an access denied error. What is the cause?

Accepted Answer

The policy allows kms:Decrypt on all resources but the CMK key policy may not grant access.. The function needs kms:Decrypt permission on the specific key. Option C is correct. Option A is wrong because the actions are allowed. Option B is wrong because the key is specific. Option D is wrong because DynamoDB encryption uses KMS.

Answer

The DynamoDB table is not encrypted with a KMS key.

Answer

The policy does not allow dynamodb:GetItem on the table.

Answer

The DynamoDB table does not exist.

Question 5

Refer to the exhibit. A developer creates a CloudFormation stack with the template. After the stack is created, the developer tries to access https://my-app-data-123.s3.amazonaws.com/index.html but gets a 403 Forbidden error. The S3 bucket has public access blocked at the account level. What should the developer do to allow public read access?

Accepted Answer

Disable the block public access settings at the account level.. Account-level public access block overrides bucket policy. Option D is correct. Option A is wrong because bucket policy already allows. Option B is wrong because account setting overrides. Option C is wrong because static website hosting is not required for direct S3 access.

Answer

Enable static website hosting on the bucket.

Answer

Modify the bucket policy to include the AWS account ID as Principal.

Answer

Add a bucket policy that grants s3:ListBucket.

Question 6

Refer to the exhibit. A developer invokes a Lambda function using the AWS CLI. The response shows StatusCode 200 and FunctionError: Unhandled. What does this indicate?

Accepted Answer

The Lambda function threw an exception that was not caught by the code.. FunctionError: Unhandled means the function threw an exception. Option C is correct. Option A is wrong because StatusCode 200 indicates invocation succeeded but function failed. Option B is wrong because function did execute. Option D is wrong because response is not an error from CLI.

Answer

The Lambda function timed out before completing.

Answer

The Lambda function executed successfully without errors.

Answer

The AWS CLI failed to invoke the function due to permissions.

Question 7

A company is using AWS Lambda with a 1 GB memory configuration. The function processes large CSV files from S3 and occasionally times out after 15 seconds. The function currently uses synchronous invocation. What is the MOST cost-effective solution to handle larger files without losing data?

Accepted Answer

Increase the Lambda timeout to 15 minutes and keep memory at 1 GB.. Option B is correct because increasing the Lambda timeout up to 15 minutes (the maximum for synchronous invocation) and keeping memory at 1 GB is cost-effective. Option A is wrong because increasing memory also increases cost without guaranteeing timeout resolution. Option C is wrong because asynchronous invocation has a 15-minute timeout but may not be suitable for all use cases. Option D is wrong because Step Functions add complexity and cost.

Answer

Switch to asynchronous Lambda invocation to allow up to 15 minutes of processing.

Answer

Increase the Lambda memory to 3 GB to improve processing speed.

Answer

Use AWS Step Functions to orchestrate the processing in smaller chunks.

Question 8

A developer is building a serverless application using API Gateway and Lambda. The API Gateway REST API endpoint needs to be accessible only from a specific VPC. Which configuration should be used?

Accepted Answer

Configure a resource policy with a condition using aws:SourceVpc.. Option C is correct because API Gateway REST APIs can be configured with a resource policy to allow access only from a specific VPC using the aws:SourceVpc condition key. Option A is wrong because private DNS is for VPC endpoints, not for controlling access. Option B is wrong because security groups are not used for API Gateway; they are for EC2. Option D is wrong because API Gateway does not have VPC endpoints in the same way as other services.

Answer

Attach a security group to the API Gateway.

Answer

Create a VPC endpoint for API Gateway and associate it with the API.

Answer

Enable private DNS on the API Gateway API.

Question 9

An application running on Amazon ECS Fargate uses a DynamoDB table with on-demand capacity. The table has a partition key of 'userId' and a sort key of 'timestamp'. During peak hours, some requests experience throttling errors. The application performs updates to existing items using 'UpdateItem' with ConditionExpression to ensure the 'status' attribute is 'active'. Which design change will BEST reduce throttling?

Accepted Answer

Implement DynamoDB Accelerator (DAX) to cache frequent items.. Option D is correct because using DynamoDB Accelerator (DAX) can reduce throttling by offloading read requests from the table, allowing on-demand capacity to handle write-heavy workloads. Option A is wrong because increasing read capacity is not applicable to on-demand tables. Option B is wrong because 'UpdateItem' with ConditionExpression already performs atomic updates. Option C is wrong because sparse indexes do not help with throttling.

Answer

Use 'TransactWriteItems' instead of 'UpdateItem' for atomic updates.

Answer

Change the table to provisioned capacity and increase read capacity units.

Answer

Create a global secondary index with the same partition key and a different sort key.

Question 10

A developer is using AWS SAM to deploy a serverless application. The template includes a Lambda function that connects to an RDS MySQL database. The function works correctly in the developer's account but fails with a timeout when deployed to a production account. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to the same VPC as the RDS instance.. Option B is correct because the Lambda function may not have a VPC configuration to access the RDS database in the production account. Option A is wrong because SAM supports RDS connections. Option C is wrong because Lambda's default timeout is 3 seconds, but the function may have a higher timeout set. Option D is wrong because Lambda supports Python natively.

Answer

The Lambda function timeout is set too low for the database query.

Answer

The SAM template does not support RDS as an event source.

Answer

The Lambda function uses a runtime that is not compatible with the MySQL client.

Question 11

A company is using Amazon SQS to decouple microservices. The producer sends messages, and the consumer processes them. The consumer occasionally fails to process a message due to transient errors. What is the BEST way to ensure such messages are retried automatically?

Accepted Answer

Configure a dead-letter queue with a redrive policy on the source queue.. Option A is correct because setting the 'redrive policy' with a dead-letter queue (DLQ) allows messages to be retried up to maxReceiveCount, and then moved to DLQ. Option B is wrong because delay queues delay all messages, not retry failures. Option C is wrong because FIFO queues still need redrive policy. Option D is wrong because visibility timeout alone does not retry on failure.

Answer

Use a delay queue to postpone message processing.

Answer

Use a FIFO queue with content-based deduplication.

Answer

Increase the visibility timeout to give the consumer more time.

Question 12

An organization uses AWS CodeBuild to run tests for a Node.js application. The build environment is Linux. The buildspec.yml includes a pre_build phase that runs 'npm install'. Occasionally, the build fails with an error 'npm ERR! code EINTEGRITY'. The developer wants to resolve this issue without compromising security. Which action should be taken?

Accepted Answer

Add 'npm cache verify' to the pre_build phase before 'npm install'.. Option B is correct because adding 'npm cache verify' before 'npm install' can fix integrity errors by clearing the cache. Option A is wrong because disabling integrity checks reduces security. Option C is wrong because 'npm install --prefer-offline' uses cache and may still have integrity issues. Option D is wrong because using a separate CodeBuild project does not solve the integrity problem.

Answer

Create a separate CodeBuild project to run npm install.

Answer

Add 'npm config set registry http://registry.npmjs.org/' to use HTTP.

Answer

Use 'npm install --prefer-offline' to avoid fetching from registry.

Question 13

A developer is designing a system where an S3 bucket receives uploads, and each upload triggers a Lambda function to process the file. The processed output is stored in another S3 bucket. The developer notices that sometimes the same file is processed multiple times. How can this be prevented?

Accepted Answer

Make the Lambda function idempotent by checking if the object has already been processed using a DynamoDB table.. Option C is correct because enabling S3 event notifications with the 'S3:ObjectCreated:*' event type and ensuring the Lambda function is idempotent (e.g., using the object key as a unique identifier) prevents duplicate processing. Option A is wrong because S3 does not have a deduplication feature for events. Option B is wrong because SQS FIFO queues can deduplicate messages, but S3 event notifications do not support FIFO queues. Option D is wrong because versioning does not prevent duplicate events.

Answer

Use an SQS FIFO queue as the event destination and enable content-based deduplication.

Answer

Enable S3 bucket replication to another bucket and trigger Lambda from the replica.

Answer

Enable S3 bucket versioning and use 's3:ObjectCreated:Put' events.

Question 14

A developer needs to securely store database credentials for a Lambda function. The credentials must be automatically rotated every 30 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because Parameter Store does not automatically rotate credentials. Option C is wrong because KMS is for encryption keys, not credential storage. Option D is wrong because CloudHSM is for hardware security modules.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM

Question 15

A company is using Amazon CloudFront to distribute static content from an S3 bucket. The content is updated frequently, but users see stale content. The developer wants to ensure that new content is served as soon as possible after an update. Which action should be taken?

Accepted Answer

Create a CloudFront invalidation for the updated files.. Option C is correct because creating a CloudFront invalidation for the updated objects ensures the edge caches are refreshed. Option A is wrong because 'Object Caching' can be set to 0, but that increases load. Option B is wrong because 'Minimum TTL' of 0 allows caching but does not clear existing cache. Option D is wrong because 'Origin Shield' reduces origin load but does not invalidate cache.

Answer

Enable 'Origin Shield' to reduce the number of requests to S3.

Answer

Set the 'Minimum TTL' to 0 and 'Default TTL' to 0.

Answer

Set the 'Object Caching' to 0 in the CloudFront distribution.