DVA-C02 Development with AWS Services Practice Test 30 — 15 Questions

Question 1

A company is building a serverless application using AWS Lambda to process user uploads to Amazon S3. The Lambda function needs to access a DynamoDB table to store metadata. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and attach it to the Lambda function.. AWS Lambda uses an IAM role (execution role) to obtain temporary credentials via the AWS Security Token Service (STS). Attaching a policy that grants DynamoDB access to this role follows the principle of least privilege and avoids long-term credentials. This is the standard, secure pattern for granting Lambda functions access to other AWS services.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's ARN.

Answer

Hardcode the DynamoDB credentials in the Lambda function code.

Question 2

A developer is using AWS CodeCommit as a source repository and AWS CodePipeline for CI/CD. The developer wants to automatically trigger a pipeline execution when changes are pushed to the main branch. Which action should the developer take?

Accepted Answer

Create an Amazon CloudWatch Events rule that detects changes to the CodeCommit repository and triggers the pipeline.. Amazon CloudWatch Events (now Amazon EventBridge) can detect CodeCommit repository state changes, such as push events to a specific branch, and automatically trigger a CodePipeline execution as a target. This is the recommended AWS-native approach for event-driven pipeline triggers without polling or manual webhook configuration.

Answer

Configure CodePipeline to poll the CodeCommit repository every minute.

Answer

Set up a webhook in CodeCommit to notify CodePipeline on push events.

Answer

Use an SNS topic to send a notification to CodePipeline when a push occurs.

Question 3

A company uses AWS Elastic Beanstalk to deploy a web application. The application stores user-uploaded images in an S3 bucket. The developer needs to ensure that the application can read and write to the S3 bucket. What should the developer do?

Accepted Answer

Configure the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access.. Elastic Beanstalk environments run on EC2 instances, and the recommended way to grant AWS permissions to those instances is by attaching an IAM instance profile. This profile includes an IAM role with a policy that allows the required S3 read and write actions, enabling the application to securely access the S3 bucket without embedding credentials in the code.

Answer

Use Amazon CloudFront to proxy requests to the S3 bucket.

Answer

Hardcode the AWS access keys in the application code.

Answer

Apply an S3 bucket policy that allows access from the Elastic Beanstalk environment's security group.

Question 4

A developer is using the AWS SDK for Python (Boto3) to upload objects to an S3 bucket. The developer wants to encrypt the objects at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which parameter should the developer include in the put_object call?

Accepted Answer

ServerSideEncryption: 'aws:kms'. To use server-side encryption with AWS KMS managed keys (SSE-KMS) when uploading an object to S3 via the put_object call, you must set the ServerSideEncryption parameter to 'aws:kms'. This tells S3 to encrypt the object using a KMS key. Option C is correct because it specifies the exact value required for SSE-KMS encryption.

Answer

SSEAlgorithm: 'AES256'

Answer

SSEKMSKeyId: 'alias/aws/s3'

Answer

ServerSideEncryption: 'AES256'

Question 5

A company has a Node.js application running on an EC2 instance. The application needs to store session state. The developer wants to ensure high availability and scalability by storing session data externally. Which AWS service is BEST suited for this purpose?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the best choice for external session storage because it provides an in-memory data store with sub-millisecond latency, which is critical for session state access in a high-traffic Node.js application. Redis supports data structures like hashes and TTL (time-to-live) for automatic session expiration, and it can be clustered for high availability and scalability, making it ideal for stateless EC2 instances behind a load balancer.

Answer

Amazon DynamoDB

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 6

A developer is deploying a microservices architecture on Amazon ECS using Fargate launch type. The services need to communicate with each other. The developer wants to use service discovery so that services can find each other by name. Which AWS service should the developer use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it is a cloud resource discovery service that allows microservices to register their DNS names and health checks, enabling dynamic service discovery. With Amazon ECS and Fargate, services can use AWS Cloud Map namespaces (either API-based or DNS-based) to resolve each other by logical service names, which is essential for inter-service communication in a microservices architecture.

Answer

Amazon Route 53 private hosted zones

Answer

Amazon ECR

Answer

Application Load Balancer

Question 7

The developer runs a scan on the DynamoDB table 'orders' with a filter expression to find items with order_status equal to 'SHIPPED'. The output shows ScannedCount of 10000 but Count of 0. Which statement is correct?

Accepted Answer

The scan retrieved 10,000 items from the table, but none matched the filter condition.. In DynamoDB, a Scan operation retrieves all items in the table or index up to the 1 MB limit, then applies any filter expression client-side. The ScannedCount of 10,000 indicates that 10,000 items were read from the table, but the Count of 0 means none of those items satisfied the filter condition (order_status = 'SHIPPED'). This is the expected behavior: filters are applied after the data is read, not before.

Answer

The scan only returned items that matched the filter, so there are no items with status SHIPPED.

Answer

The filter expression syntax is incorrect, causing the scan to return zero items.

Answer

The scan applied the filter before reading items, so only matching items were scanned.

Question 8

A developer is using AWS Step Functions to orchestrate a workflow. The developer wants to handle errors and retries for a task. Which TWO fields can be used in a state definition to configure error handling? (Choose TWO.)

Accepted Answer

Retry. The `Retry` field in an AWS Step Functions state definition defines an array of retry policies, specifying which errors to retry, the maximum number of retry attempts, the interval between retries, and the backoff rate. Option B is correct because the `Catch` field defines an array of fallback states or state machine transitions that are executed when a specific error occurs after all retry attempts are exhausted, allowing the workflow to handle errors gracefully.

Answer

FailureState

Answer

ErrorOutput

Answer

ErrorAction

Question 9

A developer is building a REST API using API Gateway and Lambda. The API must support multiple HTTP methods and use a custom domain name with an SSL certificate. The developer wants to enable caching for the /products GET endpoint to reduce latency. Which step is essential to enable caching for this specific endpoint?

Accepted Answer

Enable caching on the /products GET method and specify cache key parameters.. Enabling caching on a specific method (e.g., /products GET) in API Gateway allows you to configure cache key parameters, which control how the cache key is generated based on request parameters. This is essential for per-endpoint caching, as it ensures that only responses for the /products GET endpoint are cached, reducing latency for that specific method without affecting other endpoints.

Answer

Set the TTL (time-to-live) for the /products GET method to a non-zero value.

Answer

Flush the API cache to start fresh.

Answer

Enable caching on the API stage and set the 'Cache Status' to 'AVAILABLE'.

Question 10

A company stores sensitive user data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The bucket already has default encryption configured with SSE-S3. What is the MINIMUM change needed to meet the requirement?

Accepted Answer

Change the default encryption of the bucket to SSE-KMS with the desired KMS key.. The current bucket has default encryption set to SSE-S3, which uses AWS-managed keys, not customer-managed KMS keys. Changing the default encryption to SSE-KMS with the desired customer-managed KMS key ensures that all new objects uploaded to the bucket are automatically encrypted at rest using that key, meeting the security team's requirement without additional per-object configuration.

Answer

Add an object-level encryption setting to each object after upload.

Answer

Enable S3 Bucket Keys on the bucket.

Answer

Attach a bucket policy that denies uploads without the required KMS key.

Question 11

A company runs a containerized application on Amazon ECS using the Fargate launch type. The application needs to store temporary data that must persist across container restarts but does not need to be shared across multiple tasks. The data should be automatically deleted when the task stops. Which storage option should the developer use?

Accepted Answer

Use the ephemeral storage provided by Fargate.. Fargate provides ephemeral storage (up to 20 GB by default) that persists data across container restarts within the same task but is automatically deleted when the task stops. This matches the requirement for temporary data that does not need to be shared across tasks and is cleaned up upon task termination.

Answer

Attach an Amazon EBS volume to the task.

Answer

Mount an Amazon EFS file system to the container.

Answer

Create a Docker volume using the 'tmpfs' driver.

Question 12

A developer is writing a Lambda function that processes records from a Kinesis stream. The function must handle duplicate records and ensure exactly-once processing. Which approach should the developer use?

Accepted Answer

Use a unique identifier for each record and store processed IDs in a DynamoDB table to skip duplicates.. Exactly-once processing in a Kinesis-triggered Lambda function requires idempotency. By using a unique identifier (e.g., Kinesis sequence number or a business key) and storing processed IDs in a DynamoDB table, the function can check for duplicates before processing each record. This pattern ensures that even if Kinesis delivers the same record multiple times (due to retries or shard rebalancing), the record is only processed once.

Answer

Disable retries in the Lambda function to avoid processing duplicates.

Answer

Enable record ordering in the Kinesis stream.

Answer

Send the records to an SQS FIFO queue for deduplication.

Question 13

A company has a DynamoDB table that stores order data. The table has a partition key of OrderID and a sort key of OrderDate. The company frequently queries orders by CustomerID, which is not a key attribute. The queries are slow and consume a lot of read capacity. Which design change would MOST improve query performance?

Accepted Answer

Create a Global Secondary Index (GSI) with CustomerID as the partition key.. Creating a Global Secondary Index (GSI) with CustomerID as the partition key allows DynamoDB to efficiently query orders by CustomerID using the index's key structure, avoiding full table scans. This directly addresses the slow performance and high read capacity consumption by enabling targeted lookups instead of scanning all items and filtering.

Answer

Increase the provisioned read capacity for the table.

Answer

Change the table's primary key to use CustomerID as the partition key.

Answer

Use a FilterExpression on the CustomerID attribute in a Scan operation.

Question 14

A developer is building a serverless application using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is CPU-bound and currently experiences timeouts. What is the MOST cost-effective way to reduce execution time?

Accepted Answer

Increase the Lambda function's memory allocation. Increasing the Lambda function's memory allocation is the most cost-effective way to reduce execution time for a CPU-bound function because Lambda allocates CPU proportionally to memory. More memory means more vCPU capacity, which directly speeds up CPU-bound processing. This reduces the function's duration, and since Lambda billing is based on compute time (GB-seconds), the total cost can decrease even if the per-GB-second rate is higher.

Answer

Increase the SQS batch window size

Answer

Switch the Lambda runtime from Python to Node.js

Answer

Enable Provisioned Concurrency for the function

Question 15

A company uses Amazon DynamoDB as a session store for a web application. The application recently experienced a spike in traffic, causing increased read latency. The DynamoDB table has a read capacity of 5000 RCUs and uses eventual consistent reads. The application performs many GetItem calls. What should a developer do to improve read performance with minimal cost?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the table. DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency for GetItem calls from single-digit milliseconds to microseconds. Since the application uses eventual consistent reads and performs many GetItem operations, DAX offloads reads from the table, improving performance without increasing provisioned RCUs. This is the most cost-effective solution because it avoids scaling the table's read capacity and only charges for the cache nodes used.

Answer

Increase the read capacity to 10000 RCUs

Answer

Configure DynamoDB global tables for the application

Answer

Enable DynamoDB Streams and process updates asynchronously