DVA-C02 Development with AWS Services Practice Test 3 — 15 Questions

Question 1

A developer is deploying a microservice using Amazon ECS with Fargate. The service needs to scale based on CPU utilization. Which combination of actions is required? (Select TWO)

Accepted Answer

Create a CloudWatch alarm on the ECS service's CPUUtilization metric. To configure scaling for an ECS service on Fargate using a custom CloudWatch alarm, you must use a step scaling policy. This requires two steps: 1) Create a CloudWatch alarm based on the ECS service's CPUUtilization metric to trigger when thresholds are breached (Option B), and 2) Create an Application Auto Scaling step scaling policy (Option E) that defines how many tasks to add or remove when the alarm is triggered. Target tracking (Option C) automatically creates its own CloudWatch alarms, so manually creating an alarm is not required or used with target tracking.

Answer

Configure an ELB target group health check

Answer

Create a target tracking scaling policy for the ECS service

Answer

Enable auto scaling on the ECS cluster

Question 2

A developer is building a real-time chat application using Amazon API Gateway WebSockets and AWS Lambda. The developer notices that messages are sometimes delivered out of order. What should the developer do to ensure ordered message delivery?

Accepted Answer

Use an Amazon SQS FIFO queue to buffer messages before processing. WebSocket connections run over TCP, which guarantees in-order delivery of frames from the client to Amazon API Gateway. However, when API Gateway routes these messages to AWS Lambda, Lambda executes concurrently. This concurrent execution can lead to messages being processed, written to a database, or broadcasted to other clients out of order. To guarantee ordered processing, messages can be buffered using an Amazon SQS FIFO (First-In-First-Out) queue before being processed by Lambda, ensuring they are handled in the exact order they were received.

Answer

Increase the Lambda function's memory allocation

Answer

Use API Gateway's built-in message ordering feature

Answer

Set the 'sequenceNumber' property in the WebSocket message

Question 3

Which TWO actions should a developer take to improve the security of an AWS Lambda function that processes sensitive data?

Accepted Answer

Encrypt environment variables using AWS KMS. Encrypting environment variables with AWS KMS ensures that sensitive data, such as database credentials or API keys, is protected at rest and in transit during function deployment. This is a critical security best practice because environment variables are visible in plaintext in the Lambda console and API responses unless encrypted. KMS provides envelope encryption, where a customer master key (CMK) encrypts the data key that encrypts the environment variables, giving you full control over access and key rotation.

Answer

Use a dead-letter queue (DLQ) for failed invocations

Answer

Grant the Lambda function full access to all S3 buckets

Answer

Store secrets in the Lambda function code

Question 4

A developer is designing a serverless application that uses Amazon DynamoDB as the data store. The application must handle sudden spikes in read traffic without throttling. Which THREE actions should the developer take?

Accepted Answer

Configure DynamoDB auto scaling for the table. DynamoDB auto scaling (option A) dynamically adjusts the provisioned read and write capacity based on actual traffic patterns, using CloudWatch alarms and the Application Auto Scaling service. This ensures the table can handle sudden spikes in read traffic without manual intervention, preventing throttling exceptions.

Answer

Use a global secondary index with a different partition key

Answer

Use strongly consistent reads for all queries

Question 5

Which TWO of the following are valid use cases for Amazon S3 event notifications?

Accepted Answer

Send a notification to an SQS queue when a new object is created. Amazon S3 event notifications can be configured to publish events to an SQS queue when a new object is created (s3:ObjectCreated:*). This allows decoupled, asynchronous processing of object creation events without polling, making it ideal for workflows like log aggregation or data ingestion pipelines.

Answer

Automatically replicate objects to another bucket

Answer

Automatically delete objects after 30 days

Answer

Encrypt objects automatically with KMS

Question 6

The exhibit shows the output of a command. What does this output indicate about the bucket?

Accepted Answer

Versioning is enabled, and MFA delete is not required. The command output shows `MFA Delete: disabled` and `Versioning: Enabled`. This directly indicates that versioning is enabled on the bucket, but MFA delete is not required. Option D is correct because it matches both displayed fields exactly.

Answer

Versioning is enabled, and MFA delete is required

Answer

Versioning is suspended

Answer

Versioning is disabled

Question 7

The exhibit shows an IAM policy attached to a user. The user reports being unable to upload files to S3 bucket 'my-bucket'. What is the MOST likely cause?

Accepted Answer

The bucket policy denies the upload. The user has an IAM policy that grants s3:PutObject on 'my-bucket', but the bucket policy explicitly denies s3:PutObject for that user. Since an explicit deny in a resource-based policy overrides any allow in an identity-based policy, the upload fails. AWS IAM evaluates all policies, and a single explicit deny results in a final decision of deny.

Answer

The user needs s3:PutObjectAcl permission

Answer

The policy does not allow s3:ListBucket

Answer

The user does not have s3:GetObject permission

Question 8

A developer runs the following AWS CLI query against a DynamoDB table named 'Orders' and receives a ValidationException:

```
aws dynamodb query \
    --table-name Orders \
    --key-condition-expression "OrderID = :orderID" \
    --expression-attribute-values '{":orderID":{"S":"12345"}}'
```

What is the MOST likely cause?

Accepted Answer

The table's partition key is not named 'OrderID'. DynamoDB's Query operation requires that the KeyConditionExpression reference the table's actual partition key name exactly. If the Orders table's partition key is not named 'OrderID', the query fails with a ValidationException. The expression attribute values are formatted correctly, and a sort key is not required to query by partition key alone.

Answer

The expression attribute values are incorrectly formatted

Answer

The table does not exist

Answer

The query needs to use a sort key

Question 9

A developer is deploying an application using AWS Elastic Beanstalk. The application reads and writes data to an Amazon RDS database. The developer wants to ensure that database credentials are not stored in the application code or configuration files. What should the developer do?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them in the application code.. AWS Secrets Manager is specifically designed to protect secrets (such as database credentials, API keys, and OAuth tokens) needed to access applications, services, and IT resources. It enables you to easily rotate, manage, and retrieve database credentials throughout their lifecycle. Storing credentials in Elastic Beanstalk environment properties (Option A) is a security risk because they are stored in plaintext within the environment configuration, can be exposed via the AWS Console/API to users with Beanstalk permissions, and do not support automatic rotation.

Answer

Store the credentials as environment properties in the Elastic Beanstalk environment configuration.

Answer

Encrypt the credentials and store them in an Amazon S3 bucket. Have the application download them at startup.

Answer

Store the credentials in a separate configuration file and include it in the application source bundle.

Question 10

A developer is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to send messages to connected clients. The developer notices that the 'connectionId' changes every time a client reconnects. How should the developer store the mapping between user identity and connectionId?

Accepted Answer

Use Amazon DynamoDB to store the mapping, with user identity as the partition key and connectionId as an attribute.. Amazon DynamoDB is the recommended, fully managed, serverless key-value store for persisting WebSocket connection IDs in AWS. It offers single-digit millisecond latency, scales automatically, and integrates seamlessly with AWS Lambda without requiring VPC configuration (unlike Amazon ElastiCache, which typically requires a VPC, adding setup complexity and potential latency for Lambda functions).

Answer

Use Amazon ElastiCache to store the mapping in memory.

Answer

Use Amazon RDS to store the mapping in a relational database.

Answer

Use Amazon S3 to store the mapping as a JSON file.

Question 11

A developer is building a data processing pipeline that uses Amazon Kinesis Data Streams. The developer wants to ensure that records are processed in order within each shard. The consumer application runs on Amazon EC2 instances in an Auto Scaling group. What should the developer do to maintain ordering?

Accepted Answer

Use the Kinesis Client Library (KCL) with multiple workers in the same consumer group.. To maintain the ordering of records within each shard when running consumers on Amazon EC2 instances in an Auto Scaling Group, the developer should use the Kinesis Client Library (KCL). KCL coordinates multiple workers (instances) in the same consumer group using an Amazon DynamoDB lease table. It ensures that while multiple workers can run in parallel to scale processing, each individual shard is allocated to exactly one worker at any given time, thereby preserving the sequential order of records within each shard.

Answer

Use Amazon DynamoDB Streams to capture the order.

Answer

Use AWS Lambda as the consumer and set the batch size to 1.

Answer

Ensure that one consumer processes each shard exclusively.

Question 12

A developer is building a serverless application using AWS Lambda. The function needs to access a DynamoDB table and write logs to Amazon CloudWatch. What is the minimum set of IAM permissions the Lambda execution role must have?

Accepted Answer

dynamodb:PutItem, logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents. The Lambda execution role must include `dynamodb:PutItem` to write to the DynamoDB table, and the three `logs:` permissions (`CreateLogGroup`, `CreateLogStream`, `PutLogEvents`) are required for Lambda to create log groups/streams and send log events to CloudWatch Logs. This is the minimum set that satisfies both requirements without granting unnecessary privileges.

Answer

logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents

Answer

dynamodb:*, logs:PutLogEvents

Answer

dynamodb:GetItem, dynamodb:PutItem, logs:PutLogEvents

Question 13

A developer is deploying a Node.js application on AWS Lambda. The function uses the 'axios' library to call an external API. After deployment, the function times out after 3 seconds. The external API response time is normally under 500 ms. What should the developer do to resolve this issue?

Accepted Answer

Remove the Lambda function from the VPC.. When a Lambda function is configured to run inside a VPC, it loses its default internet access. If the function needs to call an external API, the connection will hang and eventually time out. Increasing the timeout (Option A) will not resolve this, as the network path is blocked. To resolve this, the developer should either configure a NAT Gateway in the VPC or, if VPC resources are not required, remove the Lambda function from the VPC (Option C) to restore default internet access.

Answer

Increase the Lambda function timeout to 10 seconds.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the Lambda function memory to 1024 MB.

Question 14

A company uses Amazon API Gateway with a Lambda authorizer to secure its APIs. The authorizer must verify a JWT token from a third-party identity provider. The team notices that the authorizer is called on every API request, causing additional latency. How can the team reduce the number of authorizer invocations?

Answer

Use Amazon CloudFront to cache the API responses.

Answer

Configure the Lambda authorizer to return a cached policy using the 'methodArn' and 'principalId' combination.

Answer

Enable API Gateway caching and set a TTL of 300 seconds.

Answer

Remove the Lambda authorizer and use IAM roles for authorization.

Question 15

A developer needs to deploy a containerized application on AWS. The application requires persistent storage for stateful data. Which AWS compute service should the developer choose?

Accepted Answer

Amazon ECS with Fargate. Amazon ECS with Fargate is the best choice for deploying a containerized application with persistent storage. Fargate supports persistent storage by integrating with Amazon EFS. While Amazon EKS with Fargate also supports persistent storage, ECS with Fargate offers simpler management and is often preferred for stateful containers. AWS Elastic Beanstalk can run containers but is more opinionated and less flexible for stateful configurations. AWS Lambda is stateless and ephemeral, not suitable for persistent storage.

Answer

AWS Elastic Beanstalk

Answer

Amazon EKS with Fargate

Answer

AWS Lambda