DVA-C02 Development with AWS Services Practice Test 30 — 15 Questions

Question 1

Which TWO AWS services can be used to build a serverless event-driven application that processes data from Amazon S3 and stores results in Amazon DynamoDB? (Choose 2.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be triggered directly by S3 events (e.g., ObjectCreated) to process data as soon as it arrives, and it can write the processed results to DynamoDB via the AWS SDK. This creates a fully serverless, event-driven pipeline without provisioning any servers.

Answer

Amazon Kinesis Data Streams

Answer

Amazon EC2

Answer

Amazon EMR

Question 2

A developer is designing a messaging system where orders are placed into an SQS queue and processed by a Lambda function. The developer wants to ensure that failed messages are not lost and can be analyzed later. Which TWO steps should the developer take? (Choose 2.)

Accepted Answer

Configure a dead-letter queue (DLQ) for the SQS queue.. Configuring a dead-letter queue (DLQ) for the SQS queue ensures that messages that cannot be processed successfully after a specified number of attempts are moved to a separate queue. This prevents message loss and allows the developer to analyze the failed messages later, fulfilling the requirement to not lose failed messages and to enable analysis.

Answer

Enable Lambda function retries on failure.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Set up a CloudWatch alarm to monitor the queue depth.

Question 3

A developer is building a serverless application using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to read the uploaded file, transform it, and write the result to a DynamoDB table. Which IAM policy statement should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:PutItem"],"Resource":"*"}. The Lambda function needs to read the uploaded file from S3 (requiring s3:GetObject) and write the transformed result to DynamoDB (requiring dynamodb:PutItem). Option A correctly grants both actions with a wildcard resource, which is acceptable for a learning scenario but should be scoped in production. This matches the exact permissions needed for the described workflow.

Answer

{"Effect":"Allow","Action":["s3:PutObject","dynamodb:PutItem"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:UpdateItem"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:GetItem"],"Resource":"*"}

Question 4

A developer is using AWS Elastic Beanstalk to deploy a web application. The application experiences high latency during peak hours. The developer wants to scale the application automatically based on CPU utilization. Which configuration should the developer use?

Accepted Answer

Configure an Auto Scaling simple scaling policy based on Average CPU Utilization > 70% for scale-out and < 30% for scale-in.. AWS Elastic Beanstalk integrates with Auto Scaling to automatically adjust the number of EC2 instances based on a simple scaling policy that uses the Average CPU Utilization metric. By setting a scale-out threshold at >70% and a scale-in threshold at <30%, the application can dynamically handle peak-hour traffic while reducing costs during low usage. This directly addresses the developer's requirement to scale based on CPU utilization.

Answer

Configure an Auto Scaling step scaling policy based on MemoryReservation metric.

Answer

Use AWS CloudFront to cache responses and reduce load on the application.

Answer

Configure an Auto Scaling target tracking policy based on NetworkIn metric.

Question 5

A developer needs to store application configuration data, such as database connection strings and third-party API keys, securely. The data must be encrypted at rest and automatically rotated. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, encrypt, and automatically rotate secrets such as database connection strings and API keys. It integrates with AWS KMS for encryption at rest and provides built-in rotation capabilities for supported services like Amazon RDS, Redshift, and DocumentDB, meeting the requirement for automatic rotation without custom code.

Answer

Amazon S3 with server-side encryption

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 6

A developer wants to invoke an AWS Lambda function every hour to perform a maintenance task. Which AWS service should be used to schedule the invocation?

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service for scheduling periodic invocations of AWS Lambda functions. It allows you to create a rule with a cron or rate expression (e.g., `rate(1 hour)`) that triggers the Lambda function on a defined schedule. This is the native, serverless way to run code on a recurring timer without managing any infrastructure.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Step Functions

Answer

Amazon Simple Notification Service (SNS)

Question 7

A developer is using Amazon S3 to host a static website. The website uses JavaScript to fetch data from an API Gateway endpoint. Users report that the website loads but API calls fail with HTTP 403 errors. The developer checks the S3 bucket policy and finds it allows public read access. What is the most likely cause?

Accepted Answer

The API Gateway API key is not included in the JavaScript code.. The website loads from S3, but the API calls to API Gateway fail with 403. This is often due to missing API key. If the API Gateway endpoint requires an API key and the JavaScript code does not include it in the request headers, API Gateway returns a 403 Forbidden error. Option C is correct because the most likely cause is that the API key is not included in the JavaScript code, leading to the 403 response.

Answer

The S3 bucket policy blocks access from the API Gateway domain.

Answer

The S3 bucket is not configured for static website hosting.

Answer

The S3 bucket does not have CORS configuration to allow cross-origin requests from the API Gateway domain.

Question 8

An application running on Amazon EC2 instances in an Auto Scaling group processes messages from an SQS queue. The application runs in a private subnet and needs to send metrics to Amazon CloudWatch. How can the developer ensure the EC2 instances can send metrics without traversing the internet?

Accepted Answer

Create a VPC Endpoint for CloudWatch (com.amazonaws.region.monitoring).. A VPC Endpoint for CloudWatch (com.amazonaws.region.monitoring) allows EC2 instances in a private subnet to send metrics to CloudWatch over the AWS network without traversing the internet. This is achieved by creating an Interface Endpoint (powered by AWS PrivateLink) that provides private connectivity to CloudWatch using private IP addresses from your subnet, avoiding the need for an internet gateway, NAT gateway, or virtual private gateway.

Answer

Attach a NAT Gateway to the private subnet and update the route table.

Answer

Install the CloudWatch agent on each instance and configure it to use a proxy.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to instances.

Question 9

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The function is currently active and handling traffic. The developer wants to gradually shift traffic to the new version and rollback if errors increase. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the alias to route a percentage of traffic to the new version and the rest to the current version.. Lambda aliases support weighted routing, allowing you to specify a percentage of traffic to send to a new version while the remainder goes to the current version. This enables canary deployments where you can monitor error rates and rollback by adjusting the weights without redeploying.

Answer

Invoke the Lambda function with the new version using the AWS SDK.

Answer

Update the alias to route 100% of traffic to the new version.

Answer

Use AWS CodeDeploy to create a deployment group for the Lambda function.

Question 10

A developer is building a REST API using API Gateway and Lambda. The API must be secured using a Lambda authorizer. Which THREE steps are necessary to implement the Lambda authorizer? (Choose THREE.)

Accepted Answer

Configure the API Gateway method to use the Lambda authorizer.. The API Gateway method must be explicitly configured to use the Lambda authorizer as the authorization mechanism. This is done by setting the method's Authorization type to the Lambda authorizer's logical name in the API Gateway console or via the REST API's `authorizationType` property set to `CUSTOM` and referencing the authorizer's ID. Without this configuration, API Gateway will not invoke the authorizer function for incoming requests.

Answer

Return a JSON Web Token (JWT) from the authorizer function.

Answer

Generate an API key and distribute it to clients.

Question 11

Refer to the exhibit. A developer attached the IAM policy to a Lambda function's execution role. The function reads items from a DynamoDB table that uses AWS KMS customer managed key (CMK) for encryption at rest. When the function tries to read an item, it receives an access denied error. What is the cause?

Accepted Answer

The policy allows kms:Decrypt on all resources but the CMK key policy may not grant access.. The IAM policy grants kms:Decrypt on all resources, but DynamoDB uses AWS KMS customer managed keys (CMKs) for encryption at rest. Even if the IAM policy allows the action, the CMK's key policy must also grant the Lambda execution role access to use the key. If the key policy does not include a statement allowing the Lambda role to perform kms:Decrypt, the request fails with an access denied error, regardless of the IAM policy.

Answer

The DynamoDB table is not encrypted with a KMS key.

Answer

The policy does not allow dynamodb:GetItem on the table.

Answer

The DynamoDB table does not exist.

Question 12

A developer invokes a Lambda function using the AWS CLI. The response shows StatusCode 200 and FunctionError: Unhandled. What does this indicate?

Accepted Answer

The Lambda function threw an exception that was not caught by the code.. A is correct because a StatusCode 200 from an AWS Lambda invocation via the AWS CLI indicates that the invocation request itself was accepted and processed by the Lambda service, but the presence of FunctionError: Unhandled means the function code threw an exception that was not caught by any try-catch block or error handler. This results in the Lambda service returning a 200 HTTP status for the invocation request while signaling the error via the FunctionError field in the response payload.

Answer

The Lambda function timed out before completing.

Answer

The Lambda function executed successfully without errors.

Answer

The AWS CLI failed to invoke the function due to permissions.

Question 13

A company is using AWS Lambda with a 1 GB memory configuration. The function processes large CSV files from S3 and occasionally times out after 15 seconds. The function currently uses synchronous invocation. What is the MOST cost-effective solution to handle larger files without losing data?

Accepted Answer

Increase the Lambda timeout to 15 minutes and keep memory at 1 GB.. Increasing the Lambda timeout from 15 seconds to 15 minutes directly addresses the timeout issue without incurring additional costs. Keeping memory at 1 GB avoids the higher per-GB-second cost of larger memory configurations, making it the most cost-effective solution. Lambda charges based on memory allocation and execution duration, so extending the timeout alone does not increase the cost per invocation if the function runs for the same duration.

Answer

Switch to asynchronous Lambda invocation to allow up to 15 minutes of processing.

Answer

Increase the Lambda memory to 3 GB to improve processing speed.

Answer

Use AWS Step Functions to orchestrate the processing in smaller chunks.

Question 14

A developer is using AWS SAM to deploy a serverless application. The template includes a Lambda function that connects to an RDS MySQL database. The function works correctly in the developer's account but fails with a timeout when deployed to a production account. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to the same VPC as the RDS instance.. The most likely cause is that the Lambda function is not attached to the same VPC as the RDS instance. Lambda functions run in a VPC by default only if explicitly configured; without VPC attachment, the function cannot reach the RDS database's private IP address, leading to a connection timeout. The developer's account may have had the RDS instance publicly accessible or the Lambda function was inadvertently in the same VPC, but the production account likely uses a private RDS instance in a VPC that the Lambda function is not connected to.

Answer

The Lambda function timeout is set too low for the database query.

Answer

The SAM template does not support RDS as an event source.

Answer

The Lambda function uses a runtime that is not compatible with the MySQL client.

Question 15

An organization uses AWS CodeBuild to run tests for a Node.js application. The build environment is Linux. The buildspec.yml includes a pre_build phase that runs 'npm install'. Occasionally, the build fails with an error 'npm ERR! code EINTEGRITY'. The developer wants to resolve this issue without compromising security. Which action should be taken?

Accepted Answer

Add 'npm cache verify' to the pre_build phase before 'npm install'.. The EINTEGRITY error occurs when npm's local cache contains corrupted or mismatched package data, causing integrity checks to fail. Running 'npm cache verify' in the pre_build phase validates the cache, removes corrupted entries, and garbage collects unnecessary data, ensuring subsequent 'npm install' operations use a clean cache. This resolves the issue without disabling security features like integrity checking or switching to insecure HTTP.

Answer

Create a separate CodeBuild project to run npm install.

Answer

Add 'npm config set registry http://registry.npmjs.org/' to use HTTP.

Answer

Use 'npm install --prefer-offline' to avoid fetching from registry.