DVA-C02 Development with AWS Services Practice Test 29 — 15 Questions

Question 1

A company has a Lambda function that writes to an S3 bucket. The IAM role used by the function has an inline policy allowing s3:PutObject on the bucket. However, writes fail with an access denied error. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket has a bucket policy that denies the request.. Even if the Lambda function's IAM role grants s3:PutObject, an explicit deny in the S3 bucket policy takes precedence over any allow. The access denied error indicates that the request is being evaluated and denied by the bucket policy, which overrides the IAM permission due to AWS's policy evaluation logic (explicit deny > allow).

Answer

The S3 bucket is in a different region.

Answer

The S3 bucket uses SSE-KMS encryption and the function lacks kms:Decrypt permissions.

Answer

The Lambda function does not have the correct execution role.

Question 2

A developer is designing a system that ingests high-volume data from IoT devices. The data must be processed in near real-time and then stored in Amazon S3 for analytics. Which TWO AWS services should the developer use together to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time ingestion of large data streams, such as IoT telemetry, and can capture and store data in shards for up to 365 days. AWS Lambda can be configured as a consumer of the Kinesis stream to process records in near real-time and then write the results to Amazon S3 for analytics. Together, they provide a serverless, scalable pipeline for high-volume IoT data.

Answer

Amazon SQS

Answer

Amazon SNS

Answer

Amazon EC2

Question 3

A developer is using AWS Secrets Manager to rotate database credentials. The rotation Lambda function fails with an error. Which THREE steps should the developer take to troubleshoot? (Choose THREE.)

Accepted Answer

Verify that the Lambda function has network access to the database.. The Lambda function must have network access to the database to perform the rotation (e.g., connecting to the database to change the password). Without network connectivity, the rotation cannot complete. Option D is correct because the Lambda function's IAM role needs permission to call `secretsmanager:PutSecretValue` and `secretsmanager:GetSecretValue` to update the secret in Secrets Manager. Option E is correct because CloudWatch Logs capture the Lambda function's execution output, including any error messages, stack traces, or logs from the rotation logic, which are essential for diagnosing failures.

Answer

Check VPC Flow Logs for the Lambda function's ENI.

Answer

Ensure the KMS key used to encrypt the secret is rotated.

Question 4

A developer is building a serverless application using AWS Lambda and Amazon API Gateway REST API. The API Gateway is configured to use a Lambda proxy integration. The developer wants to return a custom error message with a specific HTTP status code (e.g., 404) when a resource is not found. How should the developer implement this?

Accepted Answer

Return a JSON object with keys 'statusCode', 'headers', and 'body' where 'statusCode' is 404 and 'body' contains the error message.. With Lambda proxy integration in API Gateway, the Lambda function must return a response in the exact format that API Gateway expects: a JSON object with 'statusCode' (integer), 'headers' (object), and 'body' (string). This allows the developer to set a custom HTTP status code like 404 and include a custom error message in the body. API Gateway will then map this response directly to the HTTP response sent to the client.

Answer

Return a JSON object with 'status_code' and 'message' keys.

Answer

Throw an exception with a message that includes the HTTP status code.

Answer

Return a JSON object with 'errorMessage' and 'errorType' keys.

Question 5

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application writes to the database using the primary endpoint. The company wants to improve read performance and offload read traffic from the primary instance. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create an Amazon RDS read replica in the same region.. Amazon RDS read replicas are designed to offload read traffic from the primary DB instance. A read replica is an asynchronous copy of the primary that can serve SELECT queries, improving read performance without impacting write operations on the primary. Option C is correct because the application must explicitly use the read replica's endpoint for read queries; the replica does not automatically balance traffic. Together, creating a read replica and modifying the application to direct SELECT queries to its endpoint achieves the goal of improving read performance and offloading the primary.

Answer

Add another primary instance and configure replication.

Answer

Use the Multi-AZ secondary instance endpoint for read queries.

Answer

Enable Amazon RDS Proxy to distribute read queries across instances.

Question 6

A developer is deploying an application on Amazon ECS using Fargate. The application needs to securely access an Amazon RDS database. The developer wants to avoid hardcoding database credentials in the application code. Which THREE actions should the developer take to meet these requirements? (Choose THREE.)

Accepted Answer

Store the database credentials in AWS Systems Manager Parameter Store or AWS Secrets Manager.. AWS Systems Manager Parameter Store and AWS Secrets Manager are AWS-native services designed to securely store and manage sensitive information like database credentials. By storing credentials in these services, the developer avoids hardcoding them in the application code, adhering to security best practices. The application can then retrieve the credentials at runtime using IAM roles and permissions.

Answer

Hardcode the credentials in the application code and encrypt the code using AWS KMS.

Answer

Store the credentials in Amazon Elastic Container Registry (ECR) as a tag.

Question 7

A company is building a serverless application using AWS Lambda. The application processes messages from an Amazon SQS queue. The Lambda function is idempotent and handles duplicate messages correctly. The company needs to ensure that messages are processed in the order they were sent. Which solution should the company use?

Accepted Answer

Configure the Lambda function to poll an SQS FIFO queue with a batch size of 1.. Amazon SQS FIFO queues guarantee first-in, first-out delivery and exactly-once processing, which ensures messages are processed in the order they were sent. By configuring the Lambda function to poll the FIFO queue with a batch size of 1, each message is processed individually, preserving strict ordering without concurrency issues. The Lambda function's idempotency further ensures that any duplicate messages are handled safely, but the FIFO queue's inherent ordering is the key mechanism for maintaining sequence.

Answer

Use Amazon SNS to fan out messages to Lambda.

Answer

Use Amazon Kinesis Data Streams as the event source for Lambda.

Answer

Configure the Lambda function to poll an SQS standard queue with a batch size of 10.

Question 8

A developer is writing an AWS Lambda function that needs to read a secret from AWS Secrets Manager. The function is written in Python. What is the BEST practice for retrieving the secret?

Accepted Answer

Retrieve the secret outside the handler function and cache it in a global variable.. The best practice because retrieving the secret outside the handler function (at initialization time) and caching it in a global variable avoids making a Secrets Manager API call on every invocation. This reduces latency, cost, and the risk of hitting API rate limits. The cached value persists across warm starts within the same execution environment, aligning with AWS Lambda's lifecycle best practices.

Answer

Use AWS Systems Manager Parameter Store to store the secret.

Answer

Retrieve the secret inside the handler function every time it is invoked.

Answer

Store the secret in an environment variable.

Question 9

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. The Lambda authorizer returns an IAM policy that grants access to the API. Recently, the company noticed that some API calls are being throttled due to high latency from the authorizer. What is the MOST effective way to reduce latency?

Accepted Answer

Enable caching for the Lambda authorizer responses.. Enabling caching for the Lambda authorizer responses allows API Gateway to reuse the IAM policy returned by the authorizer for subsequent requests that match the same cache key, without invoking the Lambda function again. This eliminates the latency of the authorizer invocation on cache hits, directly addressing the throttling caused by high authorizer latency.

Answer

Use a custom authorizer instead of a Lambda authorizer.

Answer

Reduce the TTL of the authorizer cache.

Answer

Increase the memory allocated to the Lambda authorizer function.

Question 10

A developer is deploying a web application using AWS Elastic Beanstalk. The application needs to store session state. The developer wants to ensure that session data is not lost if an EC2 instance is terminated. Which solution should the developer implement?

Accepted Answer

Store session data in an Amazon ElastiCache cluster.. Amazon ElastiCache provides a managed, highly available, and durable in-memory cache that can store session state externally from EC2 instances. By using ElastiCache (e.g., Redis with replication and persistence), session data survives instance termination because it is stored in a separate, resilient service, not on the local instance.

Answer

Store session data in an Amazon EBS volume.

Answer

Store session data in an Amazon S3 bucket.

Answer

Store session data in the instance store.

Question 11

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a source stage that uses Amazon S3. The developer updates a file in the S3 bucket, but the pipeline does not start automatically. What is the MOST likely cause?

Accepted Answer

Amazon S3 versioning is not enabled on the bucket.. CodePipeline requires S3 versioning to be enabled on the source bucket to automatically detect changes and start the pipeline. Without versioning, CodePipeline cannot uniquely identify new object versions, so it relies on manual or scheduled polling instead of event-based triggers. Enabling versioning ensures that each PUT operation generates a new version ID, which CodePipeline uses to invoke the pipeline automatically.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The pipeline is configured to use polling instead of event-based triggers.

Answer

AWS CloudTrail is not enabled.

Question 12

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon S3 bucket. The company wants to follow the principle of least privilege. How should the developer provide the necessary permissions?

Accepted Answer

Create an IAM task role with S3 permissions and associate it with the ECS task definition.. Amazon ECS with Fargate launch type uses IAM task roles to grant permissions to containers at the task level. The task role is an IAM role that the ECS task assumes, allowing the application to securely access S3 without hardcoding credentials. This follows the principle of least privilege by scoping permissions to the specific task and using temporary credentials via the AWS STS service.

Answer

Use Amazon EFS to store access keys.

Answer

Assign an IAM instance profile to the Fargate tasks.

Answer

Store AWS credentials in the container image.

Question 13

A developer is using Amazon DynamoDB as the data store for a serverless application. The application experiences high read traffic, and the developer wants to reduce latency. The data is not frequently updated. Which DynamoDB feature should the developer use?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency for DynamoDB tables from single-digit milliseconds to microseconds. Since the data is not frequently updated, DAX can serve repeated read requests from its cache without hitting the underlying table, making it ideal for high-read, low-write workloads.

Answer

DynamoDB Auto Scaling

Answer

DynamoDB Global Tables

Answer

DynamoDB Time to Live (TTL)

Question 14

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to create a custom resource that runs a Lambda function during stack creation and update. What must the developer do to ensure the custom resource works correctly?

Accepted Answer

The Lambda function must send a response to an S3 pre-signed URL.. AWS CloudFormation custom resources require the Lambda function to send a response to an S3 pre-signed URL to signal completion. CloudFormation waits for this response to proceed with stack operations; without it, the stack creation or update will time out and fail.

Answer

The Lambda function must be defined in the same CloudFormation template.

Answer

The Lambda function must return a JSON object with the desired output.

Answer

The Lambda function must be written in Python.

Question 15

A developer is designing a microservices architecture where each service runs in its own Amazon ECS container. Services need to communicate with each other. The developer wants to simplify service discovery and load balancing. Which AWS service should the developer use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that allows microservices to dynamically discover each other using DNS or HTTP API calls. It integrates natively with Amazon ECS, enabling services to register themselves and resolve other services by logical names, which simplifies service discovery and load balancing across containers.

Answer

Elastic Load Balancing

Answer

Amazon ECS service discovery

Answer

Amazon Route 53