DVA-C02 Development with AWS Services Practice Test 31 — 15 Questions

Question 1

Refer to the exhibit. The IAM policy is attached to an IAM role that is assumed by an AWS Lambda function. The Lambda function needs to read and write objects in the 'my-bucket' S3 bucket, but it should never delete objects. What will happen when the function attempts to delete an object?

Accepted Answer

The delete will fail because the Deny statement explicitly denies the delete action.. The policy explicitly denies s3:DeleteObject. IAM policies are evaluated with an explicit deny override. Even if another policy allows delete, the explicit deny will take effect, and the request will be denied.

Answer

The delete will succeed because there is no explicit deny for the specific object.

Answer

The delete will succeed because the Allow statement gives full access.

Answer

The delete will fail because the Allow statement only includes GetObject and PutObject.

Question 2

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The output shows StatusCode 200 and no FunctionError. However, the application that depends on this function's output is not working correctly. What should the developer check next?

Accepted Answer

Check the Lambda function's CloudWatch Logs for any errors or unexpected output.. A StatusCode 200 indicates that Lambda accepted the invocation and ran the function without a runtime error. However, the function might have a logical error, incorrect business logic, or might be returning unexpected data. The developer should check the function's logs in CloudWatch Logs to see the actual output and any debug messages. The payload format might also be incorrect, but the invocation succeeded technically. The function's memory or timeout settings might cause issues but would typically result in an error. The IAM role might be insufficient but would show an error in logs.

Answer

Check the IAM role attached to the Lambda function for insufficient permissions.

Answer

Check the payload format against the function's expected input.

Answer

Check the Lambda function's memory and timeout configuration.

Question 3

Refer to the exhibit. A developer creates a CloudFormation stack with the above template. The stack creation fails with the error 'The runtime parameter of nodejs18.x is not supported.' What is the most likely cause?

Accepted Answer

The runtime 'nodejs18.x' is not a valid Lambda runtime; use a supported runtime like 'nodejs16.x'.. The error indicates that the Node.js 18.x runtime is not supported. At the time of this exam, Node.js 18.x is not a valid Lambda runtime; supported runtimes include nodejs14.x, nodejs16.x, and nodejs20.x. The developer should use a supported runtime. The other options are not related to the error: ZipFile is valid for inline code, the handler is correct, and the IAM role is properly defined.

Answer

The ZipFile property cannot contain inline code for Node.js functions.

Answer

The IAM role is missing necessary permissions for CloudWatch Logs.

Answer

The Handler property is incorrect; it should be 'index.handler' but with the correct filename.

Question 4

A developer is building a serverless application using AWS Lambda to process files uploaded to an S3 bucket. The files are encrypted with S3 server-side encryption using AWS KMS (SSE-KMS). The Lambda function needs to read the files and store metadata in DynamoDB. Which IAM policy statement should be attached to the Lambda execution role to allow it to decrypt the objects?

Accepted Answer

{"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"}. Option C is correct because the Lambda function needs kms:Decrypt permission for the specific KMS key used for S3 SSE-KMS encryption. Option A is wrong because s3:GetObject without kms:Decrypt would fail if the object is encrypted with SSE-KMS. Option B is wrong because kms:GenerateDataKey is used for client-side encryption, not decryption. Option D is wrong because kms:Encrypt is for encryption, not decryption.

Answer

{"Effect":"Allow","Action":["kms:Encrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:GenerateDataKey"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 5

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS MySQL database using credentials stored in AWS Secrets Manager. The ECS task role has the following IAM policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["secretsmanager:GetSecretValue"],"Resource":"arn:aws:secretsmanager:us-east-1:123456789012:secret:prod-db-*"}]}. The application fails to retrieve the secret with an AccessDeniedException. What is the most likely cause?

Accepted Answer

The secret's resource-based policy denies access to the task role.. Option B is correct because the resource-based policy on the secret must explicitly grant the ECS task role permission to retrieve the secret, even if the task role has an allow policy. Option A is wrong because the task role policy uses a wildcard, which matches the secret name. Option C is wrong because Fargate tasks can access Secrets Manager via VPC endpoints without internet. Option D is wrong because the task role, not the task execution role, is used for accessing secrets from the application.

Answer

The task execution role does not have permission to retrieve the secret.

Answer

The task is in a private subnet without a VPC endpoint to Secrets Manager.

Answer

The secret name does not match the pattern in the policy.

Question 6

A developer wants to store application configuration data that can be accessed by multiple microservices. The data is sensitive and should be encrypted at rest. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS Systems Manager Parameter Store. Option B is correct because AWS Systems Manager Parameter Store supports encrypted parameters using KMS. Option A is wrong because S3 is not a configuration store and requires additional IAM policies. Option C is wrong because DynamoDB can store configuration but does not natively encrypt at rest without additional setup. Option D is wrong because IAM is for access management, not configuration storage.

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon DynamoDB

Question 7

A developer is using AWS CodePipeline to deploy a web application to an Auto Scaling group. The pipeline includes a deploy action that uses CodeDeploy. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

Accepted Answer

The deployment configuration has a minimum healthy instances setting that is too restrictive.. Option A is correct because if the deployment configuration has a low minimum healthy instances threshold, the deployment may fail when instances become unhealthy. Option B is wrong because CodeDeploy can deploy to any instance, regardless of how it was launched. Option C is wrong because the application stops may be failing, but the error indicates a health issue. Option D is wrong because CodeDeploy Agent sends logs to CloudWatch, but that would not cause the error.

Answer

The CodeDeploy agent is not sending logs to CloudWatch.

Answer

The application's lifecycle hooks are failing during the ApplicationStop event.

Answer

The instances were launched from an AMI that does not have the CodeDeploy agent installed.

Question 8

An organization has a Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has a visibility timeout of 30 seconds. The Lambda function takes an average of 45 seconds to process each message. What is the likely behavior of this setup?

Accepted Answer

Messages will be processed multiple times because they become visible again before the function completes.. Option C is correct because the Lambda function takes longer than the visibility timeout, causing messages to become visible again before processing completes. This leads to duplicate processing. Option A is wrong because Lambda will still process the message even if it takes longer. Option B is wrong because the reserved concurrency limit may cause throttling but not duplication. Option D is wrong because messages are not deleted until the function completes, so they become visible again.

Answer

The Lambda function will be throttled due to reserved concurrency.

Answer

The Lambda function will process messages successfully with no issues.

Answer

The Lambda function will automatically increase its processing speed.

Question 9

A developer wants to trigger an AWS Lambda function every time a new object is created in an Amazon S3 bucket. Which S3 event notification configuration should be used?

Accepted Answer

s3:ObjectCreated:*. Option A is correct because s3:ObjectCreated:* captures all object creation events. Option B is wrong because s3:ObjectRemoved:* is for deletion events. Option C is wrong because s3:ObjectRestore:* is for restore events. Option D is wrong because s3:ReducedRedundancyLostObject:* is for loss of reduced redundancy objects.

Answer

s3:ObjectRestore:*

Answer

s3:ReducedRedundancyLostObject:*

Answer

s3:ObjectRemoved:*

Question 10

A company uses Amazon API Gateway to expose a REST API backed by AWS Lambda. The API is experiencing high latency. The developer suspects cold starts are contributing to the latency. Which action would be MOST effective in reducing cold start latency?

Accepted Answer

Increase the memory allocation of the Lambda function.. Option C is correct because using a larger memory configuration can reduce cold start time by providing more CPU resources. Option A is wrong because provisioned concurrency reduces cold starts but does not involve Lambda@Edge. Option B is wrong because using VPC can increase cold starts. Option D is wrong because increasing timeout does not affect cold start performance.

Answer

Place the Lambda function in a VPC to improve network latency.

Answer

Enable Lambda@Edge to cache responses.

Answer

Increase the function timeout to 15 minutes.

Question 11

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The developer wants to ensure that the DB instance is not accidentally deleted when the stack is updated. Which property should be set on the DB instance resource?

Accepted Answer

DeletionPolicy: Retain. Option D is correct because DeletionPolicy: Retain prevents the DB instance from being deleted when the stack is deleted or the resource is removed from the stack. Option A is wrong because UpdateReplacePolicy handles replacement updates, not deletion. Option B is wrong because DependsOn does not prevent deletion. Option C is wrong because DeletionPolicy: Delete is the default and does not prevent deletion.

Answer

UpdateReplacePolicy: Retain

Answer

DeletionPolicy: Delete

Answer

DependsOn: SomeOtherResource

Question 12

A developer needs to store session state data for a web application running on multiple EC2 instances. The data must be highly available and durable. Which AWS service should be used?

Accepted Answer

Amazon ElastiCache. Option B is correct because ElastiCache provides a high-performance, highly available in-memory cache suitable for session state. Option A is wrong because S3 is object storage, not ideal for low-latency session state. Option C is wrong because EBS volumes are attached to a single instance. Option D is wrong because CloudFront is a CDN, not a session store.

Answer

Amazon S3

Answer

Amazon EBS

Answer

Amazon CloudFront

Question 13

A company is designing a microservices architecture using AWS Lambda. Each microservice has its own DynamoDB table. The Lambda functions need to perform CRUD operations on their respective tables. Which TWO IAM best practices should be applied? (Choose TWO.)

Accepted Answer

Scope the IAM policy resource to the specific DynamoDB table ARN.. Options A and D are correct. A: Using separate IAM roles for each function enforces least privilege. D: Scoping IAM policies to specific DynamoDB tables using ARN ensures functions can only access their own table. Option B is wrong because using a single IAM role violates least privilege. Option C is wrong because using wildcard for all tables grants too much access. Option E is wrong because attaching policies at the account level is too broad.

Answer

Grant access to all DynamoDB tables using a wildcard in the resource ARN.

Answer

Use a single IAM role shared by all Lambda functions.

Answer

Attach the IAM policy to the AWS account instead of the role.

Question 14

A developer is using Amazon Kinesis Data Streams to ingest real-time events. The application uses the Kinesis Client Library (KCL) to process records. The developer notices that one shard is falling behind while others are processing fine. Which THREE actions can help improve processing of the lagging shard? (Choose THREE.)

Accepted Answer

Use Enhanced Fan-Out to reduce contention.. Options A, C, and D are correct. A: Increasing the number of workers can increase parallelism within a shard. C: Using Enhanced Fan-Out allows multiple consumers to read from the same shard without contention. D: Resharding splits the hot shard into multiple shards. Option B is wrong because decreasing the record size reduces data volume but is not a direct fix for lag. Option E is wrong because reducing shard count reduces parallelism.

Answer

Decrease the record size by compressing the data.

Answer

Reduce the number of shards in the stream.

Question 15

A developer is building a serverless application that uses Amazon S3 for static website hosting and AWS Lambda for dynamic API calls. The developer wants to enable logging of all API requests. Which TWO services can be used to log API requests? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Options B and D are correct. B: Amazon CloudWatch Logs can capture API Gateway logs. D: AWS CloudTrail logs API calls for auditing. Option A is wrong because S3 server access logs log S3 requests, not API calls. Option C is wrong because VPC Flow Logs log network traffic. Option E is wrong because Route 53 logs DNS queries.

Answer

VPC Flow Logs

Answer

Amazon S3 server access logs

Answer

Amazon Route 53 logs

DVA-C02 Development with AWS Services Practice Test 31 — 15 Questions

Exhibit

DVA-C02 Development with AWS Services Practice Test 31 — 15 Questions

Exhibit