DVA-C02 Development with AWS Services Practice Test 33 — 15 Questions

Question 1

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The output shows StatusCode 200 and no FunctionError. However, the application that depends on this function's output is not working correctly. What should the developer check next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Lambda function's CloudWatch Logs for any errors or unexpected output.. A StatusCode 200 with no FunctionError indicates the Lambda function executed and completed without a runtime or invocation error. However, the application may still fail if the function returns incorrect data or has logical errors. Checking CloudWatch Logs is the standard next step to inspect the actual execution logs, print statements, or handled logic errors that would reveal why the output is incorrect.

Answer

Check the IAM role attached to the Lambda function for insufficient permissions.

Answer

Check the payload format against the function's expected input.

Answer

Check the Lambda function's memory and timeout configuration.

Question 2

A developer is building a serverless application using AWS Lambda to process files uploaded to an S3 bucket. The files are encrypted with S3 server-side encryption using AWS KMS (SSE-KMS). The Lambda function needs to read the files and store metadata in DynamoDB. Which IAM policy statement should be attached to the Lambda execution role to allow it to decrypt the objects?

Accepted Answer

{"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"}. The Lambda function needs to decrypt objects encrypted with SSE-KMS. The kms:Decrypt action on the specific KMS key ARN grants the necessary permission to decrypt the S3 object data using AWS KMS. Without this, the Lambda function will receive an access denied error when trying to read the encrypted file.

Answer

{"Effect":"Allow","Action":["kms:Encrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:GenerateDataKey"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 3

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS MySQL database using credentials stored in AWS Secrets Manager. The ECS task role has the following IAM policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["secretsmanager:GetSecretValue"],"Resource":"arn:aws:secretsmanager:us-east-1:123456789012:secret:prod-db-*"}]}. The application fails to retrieve the secret with an AccessDeniedException. What is the most likely cause?

Accepted Answer

The secret's resource-based policy denies access to the task role.. The IAM policy on the ECS task role allows access to secrets matching the pattern `prod-db-*`. However, if the secret has a resource-based policy that explicitly denies access to the task role, that denial overrides the IAM allow, causing an AccessDeniedException. AWS Secrets Manager evaluates both identity-based policies (task role) and resource-based policies, and an explicit deny in either results in denial.

Answer

The task execution role does not have permission to retrieve the secret.

Answer

The task is in a private subnet without a VPC endpoint to Secrets Manager.

Answer

The secret name does not match the pattern in the policy.

Question 4

A developer wants to store application configuration data that can be accessed by multiple microservices. The data is sensitive and should be encrypted at rest. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store provides a secure, hierarchical store for configuration data and secrets. It supports encryption at rest using AWS KMS, integrates with AWS IAM for fine-grained access control, and is designed for use by multiple microservices via the AWS SDK or CLI. This makes it the ideal choice for storing sensitive application configuration that must be encrypted at rest and accessed by distributed services.

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon DynamoDB

Question 5

A developer is using AWS CodePipeline to deploy a web application to an Auto Scaling group. The pipeline includes a deploy action that uses CodeDeploy. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

Accepted Answer

The deployment configuration has a minimum healthy instances setting that is too restrictive.. The error message indicates that the deployment failed because too many instances were unhealthy or failed. The most likely cause is that the deployment configuration's minimum healthy hosts setting is too restrictive, meaning it requires a higher percentage of healthy instances during deployment than the environment can sustain, causing CodeDeploy to stop the deployment when the threshold is breached.

Answer

The CodeDeploy agent is not sending logs to CloudWatch.

Answer

The application's lifecycle hooks are failing during the ApplicationStop event.

Answer

The instances were launched from an AMI that does not have the CodeDeploy agent installed.

Question 6

An organization has a Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has a visibility timeout of 30 seconds. The Lambda function takes an average of 45 seconds to process each message. What is the likely behavior of this setup?

Accepted Answer

Messages will be processed multiple times because they become visible again before the function completes.. The Lambda function takes 45 seconds to process a message, but the SQS queue's visibility timeout is only 30 seconds. Because the processing time exceeds the visibility timeout, the message will become visible again in the queue after 30 seconds and can be received by another Lambda invocation before the first one finishes. This leads to duplicate processing. To prevent this, the SQS visibility timeout should be configured to be at least 6 times the Lambda function's timeout.

Answer

The Lambda function will be throttled due to reserved concurrency.

Answer

The Lambda function will process messages successfully with no issues.

Answer

The Lambda function will automatically increase its processing speed.

Question 7

A developer wants to trigger an AWS Lambda function every time a new object is created in an Amazon S3 bucket. Which S3 event notification configuration should be used?

Accepted Answer

s3:ObjectCreated:*. The `s3:ObjectCreated:*` event type captures all object creation events in an S3 bucket, including PUT, POST, COPY, and multipart upload completions. This is the appropriate event notification to trigger an AWS Lambda function when a new object is created.

Answer

s3:ObjectRestore:*

Answer

s3:ReducedRedundancyLostObject:*

Answer

s3:ObjectRemoved:*

Question 8

A company uses Amazon API Gateway to expose a REST API backed by AWS Lambda. The API is experiencing high latency. The developer suspects cold starts are contributing to the latency. Which action would be MOST effective in reducing cold start latency?

Accepted Answer

Increase the memory allocation of the Lambda function.. Increasing the memory allocation of a Lambda function directly correlates to allocating more CPU power, which reduces the initialization time during a cold start. AWS Lambda provisions CPU proportionally to the configured memory, so a higher memory setting speeds up the runtime environment setup and code loading, thereby lowering cold start latency.

Answer

Place the Lambda function in a VPC to improve network latency.

Answer

Enable Lambda@Edge to cache responses.

Answer

Increase the function timeout to 15 minutes.

Question 9

A developer needs to store session state data for a web application running on multiple EC2 instances. The data must be highly available and durable. Which AWS service should be used?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that is ideal for storing session state data with high availability and durability. By using ElastiCache for Redis or Memcached, session data is stored outside of individual EC2 instances, ensuring that if an instance fails, the session state is preserved and can be accessed by other instances in the application tier. ElastiCache supports replication and automatic failover, meeting the requirements for high availability and durability.

Answer

Amazon S3

Answer

Amazon EBS

Answer

Amazon CloudFront

Question 10

A company is designing a microservices architecture using AWS Lambda. Each microservice has its own DynamoDB table. The Lambda functions need to perform CRUD operations on their respective tables. Which TWO IAM best practices should be applied? (Choose TWO.)

Accepted Answer

Scope the IAM policy resource to the specific DynamoDB table ARN.. Scoping the IAM policy resource to the specific DynamoDB table ARN follows the principle of least privilege, ensuring each Lambda function can only access its own table. Option E is correct because creating a separate IAM role for each Lambda function isolates permissions, preventing a compromised function from affecting others. Together, these practices enforce granular access control in a microservices architecture.

Answer

Grant access to all DynamoDB tables using a wildcard in the resource ARN.

Answer

Use a single IAM role shared by all Lambda functions.

Answer

Attach the IAM policy to the AWS account instead of the role.

Question 11

A developer is building a serverless application that uses Amazon S3 for static website hosting and AWS Lambda for dynamic API calls. The developer wants to enable logging of all API requests. Which TWO services can be used to log API requests? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can capture and store logs from AWS Lambda function executions. When a Lambda function is invoked via an API request (e.g., through Amazon API Gateway), the function's execution details, including request IDs, timestamps, and error messages, are automatically sent to CloudWatch Logs. This enables developers to monitor and troubleshoot API-driven serverless applications.

Answer

VPC Flow Logs

Answer

Amazon S3 server access logs

Answer

Amazon Route 53 logs

Question 12

A developer is building a serverless application that processes images uploaded to an S3 bucket. The processing includes generating thumbnails and storing metadata in DynamoDB. The developer wants to ensure that the processing function is triggered only when new objects are created, not when existing objects are updated. Which S3 event notification configuration should be used?

Accepted Answer

Use s3:ObjectCreated:*. The `s3:ObjectCreated:*` event type is a wildcard that covers all object creation APIs, including `s3:ObjectCreated:Put`, `s3:ObjectCreated:Post`, `s3:ObjectCreated:Copy`, and `s3:ObjectCreated:CompleteMultipartUpload`. Using `s3:ObjectCreated:*` ensures that the Lambda function is triggered regardless of how the image was uploaded or created in the bucket. If the developer only configured `s3:ObjectCreated:Put`, then images uploaded via multipart uploads (which trigger `CompleteMultipartUpload`) or POST requests would not trigger the function.

Answer

Use s3:ObjectCreated:Post

Answer

Use s3:ObjectCreated:Put

Answer

Use s3:ObjectCreated:Copy

Question 13

A company uses AWS Lambda functions behind an API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. After a recent deployment, some users report sporadic 502 Bad Gateway errors when calling the API. The Lambda function logs show occasional 'AccessDeniedException' errors. What is the most likely cause and solution?

Accepted Answer

The Lambda execution role lacks permissions to access DynamoDB. Update the role to include the necessary DynamoDB actions.. The 'AccessDeniedException' error in the Lambda logs indicates that the Lambda function's execution role does not have the necessary IAM permissions to perform the requested DynamoDB operation. This is a common misconfiguration after deployments where the role or its attached policies are not updated to include the required DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem). The 502 Bad Gateway from API Gateway is a direct consequence of the Lambda function failing internally due to this permission error.

Answer

The Lambda function is timing out. Increase the timeout value in the Lambda configuration.

Answer

The DynamoDB table is throttling requests. Enable auto-scaling for the table.

Answer

The API Gateway request is too large. Set the payload size limit higher in API Gateway settings.

Question 14

A developer needs to store application configuration that can be accessed by multiple microservices running on Amazon ECS. The configuration must be encrypted at rest and automatically rotate secrets. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to protect secrets (such as database credentials, API keys, and OAuth tokens) and features built-in, automatic rotation of secrets using AWS Lambda. While AWS Systems Manager Parameter Store can store encrypted configuration data (using SecureString), it does not offer native automatic rotation capabilities; implementing rotation in Parameter Store requires custom integration and code.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudFormation

Answer

Amazon S3

Question 15

A developer is using AWS CodeDeploy to deploy a new version of an application to an Auto Scaling group. The deployment fails because the new instances do not pass the health check. The developer wants to automatically roll back the deployment if the health check fails. Which CodeDeploy setting should be configured?

Accepted Answer

Enable automatic rollback in the deployment group configuration.. AWS CodeDeploy provides a built-in automatic rollback feature that can be configured at the deployment group level. When enabled, if a deployment fails (e.g., due to health check failures), CodeDeploy automatically reverts to the last known successful deployment, ensuring minimal downtime and manual intervention.

Answer

Set the deployment configuration to AllAtOnce to speed up the process.

Answer

Configure a lifecycle hook to terminate failing instances.

Answer

Use a blue/green deployment strategy instead of in-place.