DVA-C02 Development with AWS Services Practice Test 33 — 15 Questions

Question 1

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function sometimes fails due to transient errors. The developer wants to ensure that failed messages are retried automatically and then sent to a dead-letter queue after three failed attempts. How should the developer configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the SQS queue with a redrive policy and a dead-letter queue. Set the maxReceiveCount to 3.. Amazon SQS supports a redrive policy that automatically moves messages to a dead-letter queue (DLQ) after a specified number of receive attempts. By setting maxReceiveCount to 3, the SQS queue will retry delivering the message to the Lambda function up to three times (including the initial attempt). After three failed processing attempts, the message is automatically sent to the configured DLQ. This approach decouples retry logic from the Lambda function itself and leverages SQS's built-in reliability features.

Answer

Enable Lambda function's DLQ and set the retry attempts to 3.

Answer

Configure the Lambda function's reserved concurrency to 0 and set the DLQ on the function.

Answer

Use an Amazon SNS topic to send failed messages to a DLQ after three Lambda invocations.

Question 2

A developer is using AWS CodePipeline to automate the deployment of a web application. The developer wants to run unit tests after the source stage and before deploying to a staging environment. Which action should the developer add to the pipeline?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service to run unit tests in a CodePipeline because it provides a fully managed build environment that can execute test commands defined in a buildspec file. By adding a CodeBuild action to the pipeline after the source stage, the developer can run unit tests and fail the pipeline if tests do not pass, ensuring only validated code proceeds to the staging deployment.

Answer

AWS CodeCommit

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 3

A developer is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The application needs to handle a sudden spike in traffic. The Lambda function performs CPU-intensive operations. What should the developer do to ensure the application scales without errors?

Accepted Answer

Configure the Lambda function with reserved concurrency and provisioned concurrency.. Reserved concurrency guarantees that the Lambda function has a dedicated pool of concurrency available to handle traffic spikes without being throttled by other functions in the account, while provisioned concurrency pre-warms execution environments to eliminate cold starts for CPU-intensive operations. This combination ensures that the application scales smoothly under sudden load without encountering Lambda throttling errors (HTTP 429) or latency spikes from cold starts.

Answer

Set the API Gateway throttling limits to a high value.

Answer

Use an Amazon SQS queue to buffer requests before processing.

Answer

Increase the Lambda function timeout to the maximum value.

Question 4

A developer creates an AWS CloudFormation stack with the template snippet shown. The stack creation fails with the error: "Bucket with name my-unique-bucket-12345 already exists." What is the MOST likely cause?

Accepted Answer

The bucket name is already taken by another AWS account.. The error message 'Bucket with name my-unique-bucket-12345 already exists' indicates that the bucket name is globally unique across all AWS accounts. Since the bucket name is already taken, the most likely cause is that another AWS account has already created a bucket with that exact name. S3 bucket names are unique across all of AWS, not just within a single account or region.

Answer

The developer does not have permission to create S3 buckets.

Answer

The CloudFormation template has a syntax error.

Answer

The bucket name was used by another stack in the same account.

Question 5

A developer wants to store session state for a web application that runs on multiple EC2 instances behind an Application Load Balancer. Which AWS service should the developer use to store the session state in a centralized, highly available location?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that supports Redis or Memcached, which are ideal for storing session state in a centralized, highly available manner. Session data requires low-latency reads and writes, and ElastiCache offers sub-millisecond performance, replication across multiple Availability Zones, and automatic failover, making it suitable for stateless web applications behind an Application Load Balancer.

Answer

Amazon RDS

Answer

Amazon S3

Answer

AWS Lambda

Question 6

A company is developing a serverless application using AWS Lambda and API Gateway. The application needs to process user uploads to Amazon S3. The Lambda function must be invoked asynchronously after an object is uploaded to an S3 bucket. Which configuration should the developer use to invoke the Lambda function?

Accepted Answer

Configure the S3 bucket to send events to Lambda by adding a Lambda trigger in the S3 bucket properties.. S3 can directly invoke Lambda asynchronously via a bucket notification configuration. When an object is uploaded, S3 publishes an event to the Lambda service, which then executes the function without requiring any intermediary services. This is the simplest and most direct way to trigger a Lambda function from an S3 event.

Answer

Configure the S3 bucket to send events to an Amazon SQS queue and have Lambda poll the queue.

Answer

Configure the S3 bucket to send events to Amazon CloudWatch Events and have CloudWatch invoke Lambda.

Answer

Configure the S3 bucket to send events to an Amazon API Gateway endpoint that triggers the Lambda function.

Question 7

A developer is deploying a microservices application using Amazon ECS with Fargate. The application consists of multiple services that need to communicate with each other over HTTP. The developer wants to ensure that service-to-service communication is encrypted in transit and that the services can discover each other by logical service names instead of IP addresses. Which combination of AWS services should the developer use?

Accepted Answer

AWS App Mesh with AWS Cloud Map. AWS App Mesh provides a service mesh that handles service-to-service communication with encryption in transit using TLS, while AWS Cloud Map enables service discovery by logical names, allowing ECS services to resolve each other via DNS or API calls. Together, they meet the requirements for encrypted HTTP communication and logical name resolution without exposing IP addresses.

Answer

Elastic Load Balancing with AWS Systems Manager

Answer

Amazon Route 53 with AWS Direct Connect

Answer

AWS Lambda with Amazon API Gateway

Question 8

A developer has written an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has 10,000 messages waiting to be processed. What will happen when the Lambda function is invoked?

Accepted Answer

Lambda will process messages with a maximum of 5 concurrent executions, each processing a batch of messages.. AWS Lambda integrates with Amazon SQS to poll the queue and invoke the function with batches of messages. The reserved concurrency of 5 caps the maximum number of concurrent executions, so Lambda will process messages with up to 5 concurrent invocations, each receiving a batch of up to 10 messages (default batch size). The remaining messages remain in the queue until they are processed or the visibility timeout expires.

Answer

Lambda will automatically increase reserved concurrency to handle the load.

Answer

Lambda will reject the invocation because reserved concurrency is too low.

Answer

Lambda will scale up to 20 concurrent executions to process all messages quickly.

Question 9

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a build stage that uses AWS CodeBuild. The developer wants to run unit tests and only proceed to the deploy stage if the tests pass. Which configuration should the developer use to achieve this?

Accepted Answer

Configure the build stage to run tests and fail the build if tests fail; CodePipeline will automatically stop.. AWS CodeBuild can be configured to run unit tests as part of the build phase. If any test fails, CodeBuild exits with a non-zero status, causing the build to fail. CodePipeline automatically stops the pipeline execution when a stage fails, preventing the deploy stage from running. This is the native and simplest way to gate deployment on test success.

Answer

Configure a manual approval step before the deploy stage.

Answer

Configure Amazon CloudWatch alarms to stop the pipeline if tests fail.

Answer

Configure AWS Lambda to invoke a function that checks test results and manually stops the pipeline.

Question 10

A development team is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to maintain a connection to each user and broadcast messages to all connected clients. Which approach should the developer use to scale the application efficiently?

Accepted Answer

Store connection IDs in Amazon DynamoDB and use the API Gateway Management API to send messages to all connections.. DynamoDB provides a scalable, serverless key-value store to persist WebSocket connection IDs, and the API Gateway Management API allows Lambda to send messages directly to any connected client via its connection ID. This combination efficiently handles the broadcast requirement without managing infrastructure, as Lambda can iterate over stored connection IDs and call the Management API for each message.

Answer

Use Amazon ElastiCache to cache connection IDs and have Lambda send messages using the Redis pub/sub feature.

Answer

Use Amazon SNS to publish messages to all connected clients via the WebSocket API.

Answer

Use Amazon SQS to queue messages and have Lambda poll the queue to send messages to all connections.

Question 11

A developer is using AWS SAM to define a serverless application. The application includes an AWS Lambda function that needs to access an Amazon DynamoDB table. The developer wants to grant the Lambda function the minimum required permissions to read and write items in the table. Which resource should the developer use to define the IAM permissions?

Accepted Answer

AWS::Serverless::Function Policies property. The AWS::Serverless::Function resource's Policies property allows you to attach IAM policies directly to the Lambda function's execution role in a declarative manner. By specifying a policy statement with dynamodb:GetItem, dynamodb:PutItem, etc., and the ARN of the DynamoDB table, you grant the minimum required permissions for read and write access without manually creating an IAM role. SAM automatically creates and associates the IAM role with the function, simplifying permission management.

Answer

AWS::DynamoDB::Table

Answer

AWS::IAM::Role

Answer

AWS::Lambda::Permission

Question 12

A company runs a batch processing job on Amazon ECS using Fargate. The job processes files from an S3 bucket and writes results to another S3 bucket. The job runs once per day and takes about 30 minutes. The company wants to reduce costs by stopping the ECS service when not in use. Which solution should the developer implement?

Accepted Answer

Use AWS Batch with a Fargate launch type and schedule the job with Amazon EventBridge.. AWS Batch with a Fargate launch type is the ideal solution because it is purpose-built for batch processing jobs that run to completion. By scheduling the job with Amazon EventBridge, you can trigger the job once per day, and AWS Batch automatically provisions the Fargate compute environment only when the job runs, then scales down to zero after completion—eliminating costs during idle periods. This approach directly addresses the requirement to reduce costs by stopping the ECS service when not in use, without manual intervention.

Answer

Use an AWS Lambda function to run the job and configure a scheduled event in Amazon EventBridge.

Answer

Use Amazon ECS Service Auto Scaling to scale the service down to zero tasks when not in use.

Answer

Use an Amazon EC2 Auto Scaling group to launch an instance, run the job, and then terminate.

Question 13

A developer is deploying a web application on Amazon EKS. The application needs to read configuration data from an Amazon S3 bucket at startup. The developer wants to ensure that the configuration is securely accessed without embedding AWS credentials in the application code. Which solution should the developer use?

Accepted Answer

Use IAM roles for service accounts (IRSA) to assign an IAM role to the pod.. IAM roles for service accounts (IRSA) allows you to associate an IAM role with a Kubernetes service account, which the pod can assume to obtain temporary AWS credentials via the AWS STS endpoint. This eliminates the need to embed long-term credentials in the application code or environment variables, and the credentials are automatically rotated by the AWS SDK. The pod retrieves the configuration from S3 using the assumed role's permissions, ensuring secure access.

Answer

Store the AWS credentials in AWS Secrets Manager and retrieve them at startup.

Answer

Assign an IAM instance profile to the EC2 instances running the EKS nodes.

Answer

Embed the AWS access key and secret key in a Kubernetes ConfigMap.

Question 14

A developer is building a serverless application using AWS Lambda to process files uploaded to an S3 bucket. The files are encrypted with S3 server-side encryption using AWS KMS (SSE-KMS). The Lambda function needs to read the files and store metadata in DynamoDB. Which IAM policy statement should be attached to the Lambda execution role to allow it to decrypt the objects?

Accepted Answer

{"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"}. The Lambda function needs to decrypt objects encrypted with SSE-KMS. The kms:Decrypt action on the specific KMS key ARN grants the necessary permission to decrypt the S3 object data using AWS KMS. Without this, the Lambda function will receive an access denied error when trying to read the encrypted file.

Answer

{"Effect":"Allow","Action":["kms:Encrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:GenerateDataKey"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 15

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS MySQL database using credentials stored in AWS Secrets Manager. The ECS task role has the following IAM policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["secretsmanager:GetSecretValue"],"Resource":"arn:aws:secretsmanager:us-east-1:123456789012:secret:prod-db-*"}]}. The application fails to retrieve the secret with an AccessDeniedException. What is the most likely cause?

Accepted Answer

The secret's resource-based policy denies access to the task role.. The IAM policy on the ECS task role allows access to secrets matching the pattern `prod-db-*`. However, if the secret has a resource-based policy that explicitly denies access to the task role, that denial overrides the IAM allow, causing an AccessDeniedException. AWS Secrets Manager evaluates both identity-based policies (task role) and resource-based policies, and an explicit deny in either results in denial.

Answer

The task execution role does not have permission to retrieve the secret.

Answer

The task is in a private subnet without a VPC endpoint to Secrets Manager.

Answer

The secret name does not match the pattern in the policy.