DVA-C02 Development with AWS Services Practice Test 3 — 15 Questions

Question 1

A developer attaches this IAM policy to a user. The user tries to upload an object to example-bucket without specifying encryption. What will happen?

Accepted Answer

The upload fails with an access denied error.. The question stem refers to 'this IAM policy' but does not provide the policy document. We must include the IAM policy in the stem. To align with the explanation, the policy should use 'StringNotEqualsIfExists' so that a missing encryption header triggers the Deny effect.

Answer

The upload succeeds only if the object is smaller than 5 GB.

Answer

The upload succeeds but the object is not encrypted.

Answer

The upload succeeds because S3 default encryption is applied.

Question 2

A developer deploys this CloudFormation template. The Lambda function fails to access the DynamoDB table 'MyTable'. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks DynamoDB permissions.. The Lambda function requires an IAM execution role with permissions to perform DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem) on the 'MyTable' table. Without these permissions, the SDK call to DynamoDB will fail with an AccessDeniedException, even if the template deploys the table and function correctly.

Answer

The runtime nodejs18.x is incorrect for this handler.

Answer

The S3 bucket 'my-bucket' does not exist.

Answer

The environment variable TABLE_NAME is misspelled.

Question 3

A developer is using AWS CodePipeline to automate a build and deploy process. The pipeline has a build stage that uses AWS CodeBuild and a deploy stage that uses AWS CodeDeploy. The build stage produces a build artifact that is stored in Amazon S3. The deploy stage fails with 'NoSuchKey' error. What is the MOST likely cause?

Accepted Answer

The CodeDeploy application does not have the correct service role.. The stem states that 'The build stage produces a build artifact that is stored in Amazon S3.' This directly contradicts Option C, which claims no OutputArtifact is configured. Furthermore, CodePipeline validation prevents creating or running a pipeline where a CodeDeploy action lacks a matching input/output artifact. According to AWS documentation, a 'NoSuchKey' error during CodeDeploy deployment (when the artifact actually exists in S3) is typically caused by the CodeDeploy service role or EC2 instance profile lacking permissions to access the S3 bucket or decrypt the KMS key, making Option A the correct answer.

Answer

The CodeBuild project does not have permissions to upload to the S3 bucket.

Answer

The pipeline does not have an OutputArtifact configured for the build stage, so the artifact is not passed to the deploy stage.

Answer

The S3 bucket policy does not allow CodePipeline to access the artifact.

Question 4

A developer is using AWS Lambda with Amazon API Gateway to build a REST API. The Lambda function is written in Node.js and uses the 'aws-sdk' to interact with DynamoDB. When the function is invoked, it consistently takes more than 10 seconds to complete, causing API Gateway to timeout (default timeout is 29 seconds). The developer wants to reduce latency. What should the developer do FIRST?

Accepted Answer

Increase the Lambda function timeout in the function configuration.. By default, the AWS SDK for JavaScript (v2) in Node.js does not reuse TCP connections, meaning a new TCP handshake is performed for every single DynamoDB request. This adds significant latency to functions making multiple sequential calls. Setting the environment variable `AWS_NODEJS_CONNECTION_REUSE_ENABLED` to `1` instructs the SDK to reuse connections (HTTP keep-alive), which drastically reduces latency.

Answer

Switch from DynamoDB to Amazon RDS for faster queries.

Answer

Attach an IAM role to the Lambda function to speed up DynamoDB access.

Answer

Enable provisioned concurrency on the Lambda function to reduce cold starts.

Question 5

An AWS CLI command invokes a Lambda function. The response includes 'FunctionError': 'Handled'. What does this indicate?

Accepted Answer

The function threw an exception that was caught and returned as an error.. An AWS CLI command invokes a Lambda function. The response includes 'FunctionError': 'Handled'. What does this indicate?

Answer

The function had a permission error.

Answer

The function executed successfully.

Answer

The function timed out.

Question 6

A company is using AWS CloudFormation to deploy a web application. The template creates an Auto Scaling group, an Application Load Balancer, and a security group. The developer wants to ensure that the stack update fails if the new Auto Scaling group instances fail health checks. Which THREE steps should the developer take? (Choose THREE.)

Accepted Answer

Configure the Auto Scaling group to send a signal to CloudFormation using cfn-signal.. Option A is correct because cfn-signal is the mechanism by which instances (or the Auto Scaling group's lifecycle) notify CloudFormation that the required number of signals has been received; without those signals, the CreationPolicy/UpdatePolicy wait condition times out and the stack operation fails. Option B is correct because associating the Auto Scaling group with the ALB target group is what makes the load balancer's health checks apply to the instances; the UpdatePolicy's health-check behavior depends on the group being attached to the target group so that unhealthy instances are detected and replaced. Option D is correct because an UpdatePolicy with AutoScalingRollingUpdate (e.g., MinInstancesInService, MaxBatchSize, PauseTime) controls how instances are replaced during an update and, combined with the target group health checks, causes the update to fail/roll back if new instances do not pass health checks. Option C is not correct here because a CreationPolicy only governs initial resource creation signaling, not the update-failure behavior the scenario requires. Option E is not correct because AWS::CloudFormation::Init is only for configuring software on instances via cfn-init; it does not itself perform stack-update health-check gating.

Answer

Add a CreationPolicy to the Auto Scaling group.

Answer

Use the AWS::CloudFormation::Init metadata to run a health check script.

Question 7

The IAM policy above is attached to a user. The user tries to decrypt a KMS key with encryption context {"department": "finance"}. What will happen?

Accepted Answer

The action is allowed because the Allow statement matches the encryption context.. The question stem references an IAM policy ('The IAM policy above is attached to a user...'), but no policy is provided in the prompt. Without the policy, it is impossible to evaluate the correctness of the options or the explanation.

Answer

The action is denied because the Deny statement applies to all resources.

Answer

The action is denied because there is an explicit Deny that overrides any Allow.

Answer

The action is denied because the Allow statement does not explicitly allow.

Question 8

A company is using AWS Step Functions to orchestrate a workflow that processes orders. The workflow includes a task that calls a Lambda function to validate the order. If the validation fails, the workflow should wait for manual approval before proceeding. What is the MOST efficient way to implement this manual approval step?

Accepted Answer

Use a Step Functions activity task that sends a message to an Amazon SQS queue. The approval process polls the queue and sends a task success response with the .taskToken.. The callback pattern (.waitForTaskToken) allows Step Functions to pause a workflow execution until it receives a task token back. By configuring a Task state to send a message to an Amazon SQS queue (or SNS topic) with the task token, the workflow pauses. An external approval system (such as a web app or Lambda function triggered by an approval action) can then call SendTaskSuccess or SendTaskFailure with the token to resume the workflow. This is the most efficient and native way to implement manual approvals.

Answer

Publish a message to an Amazon SNS topic that triggers an email to the approver. The workflow continues after a fixed timeout.

Answer

Schedule a CloudWatch Events rule to trigger a Lambda function that checks for approval status in a DynamoDB table.

Answer

Use Amazon Cognito to manage user identities and require the approver to authenticate via a web portal.

Question 9

A company has a production AWS Lambda function that processes critical financial transactions. The function's code is stored in an S3 bucket. A developer accidentally deletes the S3 bucket, causing the function to fail. The developer wants to prevent this in the future by ensuring that the Lambda function can always be updated and deployed even if the original S3 bucket is deleted. What should the developer do?

Accepted Answer

Update the Lambda function code directly using the AWS CLI or SDK, and remove the dependency on S3 for future updates.. Updating the Lambda function code directly via the AWS CLI or SDK (e.g., using `update-function-code` with the `--zip-file` parameter) eliminates the dependency on an external S3 bucket for deployment. By uploading the code directly, the function remains deployable even if the original S3 bucket is deleted. This approach ensures the deployment artifact is stored within the Lambda service itself, decoupling it from S3 bucket availability.

Answer

Enable AWS CloudTrail to monitor bucket deletions.

Answer

Set up cross-region replication to another S3 bucket.

Answer

Enable versioning on the S3 bucket.

Question 10

A developer is using AWS CodePipeline to automate the deployment of a web application. The pipeline has a source stage that pulls code from an Amazon S3 bucket. Which TWO actions can the developer take to automatically trigger the pipeline when new code is uploaded to the S3 bucket?

Accepted Answer

Configure an S3 event notification that sends to an Amazon SNS topic, which triggers an AWS Lambda function that starts the pipeline.. Option B is correct because S3 event notifications can publish s3:ObjectCreated:* events to an Amazon SNS topic, and an AWS Lambda function subscribed to that topic can call codepipeline:StartPipelineExecution to start the pipeline automatically. Option C is correct because Amazon CloudWatch Events (now Amazon EventBridge) can match S3 object-creation events and invoke CodePipeline as a target, directly starting the pipeline when new code lands in the bucket. Option A is incorrect because SQS polling is not a native S3-to-CodePipeline trigger and would require custom polling logic rather than an event-driven start. Option D is incorrect because periodic Lambda checks are polling, not automatic event-driven triggering, and add latency. Option E is incorrect because AWS CodeStar does not detect S3 bucket changes or trigger CodePipeline in this manner.

Answer

Configure an Amazon SQS queue to poll the S3 bucket for new objects and invoke the pipeline.

Answer

Use an AWS Lambda function that periodically checks the S3 bucket for new objects.

Answer

Use AWS CodeStar to automatically detect changes in the S3 bucket.

Question 11

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to the S3 bucket 'example-bucket' from an IP address 198.51.100.5. What will happen?

Accepted Answer

The request is allowed because the action s3:PutObject is allowed.. The IAM policy grants permission for the `s3:PutObject` action on `arn:aws:s3:::example-bucket/*` under the condition that the request originates from the IP range `198.51.100.0/24`. Since the user's IP address (198.51.100.5) falls within this CIDR block, the condition is satisfied, and the request is allowed. A bucket policy is not required if the IAM policy already grants the necessary permissions.

Answer

The request is allowed because the user is an IAM user.

Answer

The request is denied because the source IP does not match the condition.

Answer

The request is denied because the bucket policy is missing.

Question 12

Refer to the exhibit. An IAM policy statement is attached to an AWS Lambda function's execution role. The function needs to invoke another Lambda function named 'my-function'. However, the invocation fails with an access denied error. What is the most likely cause?

Accepted Answer

The action should be 'lambda:*' to allow all Lambda actions.. In AWS IAM, the permission required to invoke a Lambda function is `lambda:InvokeFunction`. Although the API action is called `Invoke`, the corresponding IAM action is `lambda:InvokeFunction`. Using `lambda:Invoke` is invalid and will result in an AccessDeniedException.

Answer

The Lambda function has a timeout set too low.

Answer

The resource ARN is missing the function name.

Answer

The policy is attached to the wrong IAM role.

Question 13

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The application experiences occasional throttling on DynamoDB writes. The developer wants to implement a retry mechanism with exponential backoff. Which THREE steps should the developer take?

Accepted Answer

Configure a dead-letter queue (DLQ) for the Lambda function to capture failed events.. Option B is correct because configuring a dead-letter queue (DLQ) for the Lambda function captures events that fail after all retries are exhausted, which is essential for handling persistent DynamoDB throttling and preventing data loss. Option D is correct because the AWS SDK already implements built-in retry behavior with exponential backoff and jitter for retryable errors such as ProvisionedThroughputExceededException, so leveraging it avoids reinventing retry logic. Option E is correct because implementing custom retry logic with exponential backoff in the Lambda function gives the developer explicit control over retry timing and behavior when the SDK's default retries are insufficient. Option A is not correct because using Amazon SQS to buffer writes is an architectural decoupling pattern, not a retry mechanism with exponential backoff. Option C is not correct because increasing provisioned write capacity addresses capacity limits but does not implement a retry mechanism with exponential backoff.

Answer

Use Amazon SQS to buffer write requests to DynamoDB.

Answer

Increase the DynamoDB table's provisioned write capacity.

Question 14

A company uses AWS CodeBuild to build and test code. The buildspec.yml includes a pre-build phase that downloads dependencies from a private repository. The developer wants to securely store the credentials for the private repository. Which AWS service should the developer use to store these credentials and reference them in the buildspec?

Accepted Answer

Store the credentials in AWS Systems Manager Parameter Store and reference them in the buildspec.. AWS Systems Manager Parameter Store is the correct choice because it provides secure storage for configuration data and secrets, and CodeBuild natively supports referencing parameters from Parameter Store directly in the buildspec.yml using the 'parameter-store' block under 'env'. While AWS Secrets Manager is also natively supported in CodeBuild, Option B is incorrect because it suggests using the AWS CLI in the build phase to retrieve the secrets, which is an anti-pattern and adds unnecessary complexity compared to native buildspec referencing.

Answer

Store the credentials in an S3 bucket with server-side encryption.

Answer

Store the credentials in AWS Secrets Manager and use the AWS CLI in the build phase to retrieve them.

Answer

Store the credentials in the buildspec.yml file as environment variables.

Question 15

A developer is using AWS CodePipeline to deploy a microservices application to Amazon ECS using the 'Rolling update' deployment type. The pipeline includes a source stage (CodeCommit), build stage (CodeBuild), and deploy stage (CodeDeploy to ECS). After a recent commit, the build stage succeeds, but the deploy stage fails with 'The service has reached the maximum number of running tasks.' What is the MOST likely cause?

Accepted Answer

The task definition is misconfigured and the task fails to start.. During a rolling update deployment in Amazon ECS, the service scheduler uses the `minimumHealthyPercent` and `maximumPercent` parameters to determine how many tasks can be stopped and started:
- `minimumHealthyPercent` represents the lower limit on the number of tasks that must remain running and healthy during a deployment (as a percentage of the desired count).
- `maximumPercent` represents the upper limit on the number of tasks that can be running during a deployment (as a percentage of the desired count).

If both are set to 100% and the desired count is 2:
- Since `minimumHealthyPercent` is 100%, the scheduler must keep at least 2 healthy tasks running at all times. It cannot stop any existing tasks first.
- Since `maximumPercent` is 100%, the scheduler cannot run more than 2 tasks at any time. It cannot start any new tasks first.
This creates a deadlock where the deployment cannot progress and eventually times out. To fix this, `maximumPercent` should be increased (e.g., to 200%) or `minimumHealthyPercent` should be decreased (e.g., to 50%).

Answer

The ECS service is configured with auto scaling and has reached the maximum task count.

Answer

The ECS service has reached the AWS account service quota for Fargate tasks.

Answer

The CodeDeploy deployment configuration uses a 'canary' instead of 'rolling' update.