DVA-C02 Development with AWS Services Practice Test 34 — 15 Questions

Question 1

A developer needs to access a DynamoDB table from a Lambda function. The Lambda function is in the same AWS account as the DynamoDB table. What is the most secure way to grant the Lambda function access to the DynamoDB table?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and assign it as the Lambda execution role.. The most secure and standard way to grant a Lambda function access to DynamoDB is to create an IAM role with a policy that grants the necessary DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem) and assign that role as the Lambda execution role. This follows the principle of least privilege and avoids hardcoding credentials, as Lambda automatically assumes this role and manages temporary security credentials. While DynamoDB supports resource-based policies, the Lambda execution role (identity-based policy) remains the standard and recommended approach for granting a Lambda function access to resources within the same account.

Answer

Use the AWS account root user credentials.

Answer

Store the AWS access key and secret access key in the Lambda environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function.

Question 2

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses sessions stored in an ElastiCache Redis cluster. Recently, users have been experiencing session timeouts and errors. The developer notices that the Redis cluster is running out of memory. What should the developer do to resolve this issue?

Accepted Answer

Enable the 'allkeys-lru' eviction policy in the Redis parameter group.. Enabling the 'allkeys-lru' eviction policy in the Redis parameter group allows Redis to automatically evict the least recently used keys when memory is full, preventing session timeouts and errors caused by out-of-memory conditions. This policy is specifically designed for use cases like session storage where losing old sessions is acceptable to free memory for new ones.

Answer

Increase the session timeout in the application configuration.

Answer

Reduce the number of EC2 instances behind the load balancer.

Answer

Migrate from Redis to a Memcached cluster.

Question 3

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API must support CORS to allow requests from a web application hosted on a different domain. The developer has enabled CORS on the API Gateway resource and configured the Lambda function to return the appropriate headers. However, the web application is still receiving CORS errors. What is the most likely cause?

Accepted Answer

The API Gateway stage is not redeployed after enabling CORS.. When you enable CORS in the API Gateway console, it creates or updates the OPTIONS method for the resource. However, these configuration changes do not take effect until the API is redeployed to a stage. If the developer does not redeploy the API, the preflight OPTIONS request will fail (typically returning a 403 or 404), which the browser interprets as a CORS error. Since the developer already configured the Lambda function to return the headers, the missing step is redeploying the API stage.

Answer

The API Gateway CORS configuration is incorrect; the allowed origin should be set to '*'.

Answer

The web application is not sending the preflight OPTIONS request.

Answer

The Lambda function is not returning the CORS headers in the response.

Question 4

A developer wants to store session state for a web application running on multiple EC2 instances. Which AWS service provides a fully managed, in-memory data store that is ideal for this use case?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides a fully managed, in-memory data store that is ideal for storing session state across multiple EC2 instances. Redis supports atomic operations, TTL-based key expiration, and high-speed reads/writes, making it perfect for session management where low-latency access and automatic data eviction are critical. Unlike disk-based stores, ElastiCache for Redis keeps session data in memory, ensuring sub-millisecond response times and seamless scaling as the web application grows.

Answer

Amazon S3

Answer

Amazon DynamoDB

Answer

Amazon RDS for MySQL

Question 5

A developer is building a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which TWO AWS services can be used for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is a cloud resource discovery service that allows you to define custom names for your application resources and maintain the updated location of these dynamically changing resources. For Amazon ECS with Fargate, you can register each service instance with Cloud Map, and other services can then discover them via DNS queries or API calls, enabling seamless inter-service communication in a microservices architecture.

Answer

Amazon ECR

Answer

Elastic Load Balancing

Answer

AWS Systems Manager Parameter Store

Question 6

A company runs a critical application on AWS Lambda that processes real-time financial transactions. The Lambda function is triggered by an SQS queue that receives messages from an API Gateway. Recently, the team has observed an increase in processing errors and occasional data loss. Upon investigation, they find that the Lambda function's concurrency limit is set to 5, and the SQS queue has a visibility timeout of 30 seconds. The function typically takes 2 seconds to process a message, but during peak hours, the queue depth grows to thousands of messages. The errors occur when the Lambda function throws an exception, causing the message to return to the queue after the visibility timeout expires. However, some messages are never processed again and are eventually lost. The team suspects that the messages are being sent to the dead-letter queue (DLQ) after multiple retries, but the DLQ is not configured. The team needs to ensure that no messages are lost and that processing errors are handled appropriately. What should the team do to resolve this issue?

Accepted Answer

Configure a dead-letter queue on the SQS source queue and set the maximum receives to 3. Implement error handling in the Lambda function to catch exceptions and log them.. Messages are lost because the SQS source queue has no dead-letter queue and the Lambda function has no error handling, so after repeated failed receives messages are discarded or expire. Configuring a DLQ on the source queue with a maximumReceiveCount of 3 preserves failed messages, and adding try/catch error handling in the function ensures exceptions are logged and handled rather than silently failing. This directly addresses both the data loss and the error-handling requirement.

Answer

Increase the Lambda concurrency limit to 100 and set the SQS visibility timeout to 60 seconds.

Answer

Configure an Amazon CloudWatch alarm on the queue depth and set a Lambda function as the on-failure destination for asynchronous invocations.

Answer

Change the Lambda invocation mode to synchronous and use API Gateway as a proxy to invoke the function directly.

Question 7

A company runs a containerized application on Amazon ECS Fargate. The application writes logs to stdout. The operations team wants to centralize log monitoring and set up alarms for error patterns. What should a developer do to meet these requirements with minimal operational overhead?

Accepted Answer

Configure the ECS task definition to use the awslogs log driver and set the log group.. The awslogs log driver is the native, zero-configuration way to send container stdout/stderr to Amazon CloudWatch Logs from ECS Fargate. By specifying the awslogs log driver and a log group in the task definition, logs are automatically forwarded without any additional agents, code changes, or infrastructure, meeting the requirement for minimal operational overhead.

Answer

Use Amazon Kinesis Data Firehose to stream logs to Amazon S3 and then to CloudWatch Logs.

Answer

Modify the application code to use the AWS SDK for CloudWatch Logs to put log events.

Answer

Install the CloudWatch agent in the container and configure it to send logs.

Question 8

A company is using AWS CodePipeline to automate deployments. The pipeline has a source stage that retrieves code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The build stage is failing intermittently with errors related to missing dependencies. What should a developer do to ensure the build environment has all required dependencies?

Accepted Answer

Create a custom buildspec.yml file in the source code that installs the dependencies in the install phase.. The buildspec.yml file defines the build phases for AWS CodeBuild, including the install phase where you can specify commands to install dependencies (e.g., using package managers like pip, npm, or apt-get). By placing this file in the source code, the build environment automatically executes these commands on every build, ensuring all required dependencies are present and consistent across runs, which resolves intermittent failures caused by missing dependencies.

Answer

Configure environment variables in CodePipeline to set dependency paths.

Answer

Manually install dependencies on the CodeBuild build server each time.

Answer

Use AWS CodeCommit as the source repository instead of S3.

Question 9

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses a MySQL database. During deployment, the developer needs to apply database schema migrations. Which approach should the developer use to run database migrations as part of the Elastic Beanstalk deployment?

Accepted Answer

Use an .ebextensions configuration file to run a migration script during deployment.. Elastic Beanstalk supports .ebextensions configuration files that can execute custom commands or scripts during deployment. By placing a migration script (e.g., a shell script that runs `mysql` commands or a framework migration tool) in the `.ebextensions` directory and using the `commands` or `container_commands` key, the developer can ensure the migration runs automatically after the application is deployed but before the new environment serves traffic. This approach integrates the migration into the deployment lifecycle without external dependencies.

Answer

Configure an RDS event subscription to trigger a Lambda function that runs migrations.

Answer

Run the migration script as a scheduled task using CloudWatch Events.

Answer

Use AWS CodeDeploy's AppSpec file to run the migration script.

Question 10

A developer is using Amazon DynamoDB to store session data for a web application. The application reads and writes a single item per user session. The traffic pattern shows occasional spikes. The developer wants to minimize read and write costs. Which DynamoDB capacity mode should the developer choose?

Accepted Answer

On-demand capacity. On-demand capacity mode is ideal for unpredictable traffic patterns with occasional spikes because it automatically scales read and write throughput based on actual usage, charging only for consumed operations. Since the application reads and writes a single item per session and experiences spikes, on-demand eliminates the need to provision for peak capacity, minimizing costs compared to over-provisioning.

Answer

Reserved capacity

Answer

Provisioned capacity with manual scaling

Answer

Provisioned capacity with auto scaling

Question 11

A company uses AWS CloudFormation to deploy infrastructure. The developer needs to pass a list of security group IDs to an EC2 instance launch configuration. The security groups are created in another stack. How should the developer obtain the security group IDs?

Accepted Answer

Use Fn::ImportValue to import the exported outputs from the other stack.. Fn::ImportValue is designed to retrieve exported outputs from another CloudFormation stack. When security groups are created in a separate stack, the developer must export their IDs using the Export field in the Outputs section of that stack, and then use Fn::ImportValue in the current stack to reference those exported values. This is the standard cross-stack reference mechanism in CloudFormation, enabling decoupled infrastructure management.

Answer

Use Fn::GetAtt to retrieve the IDs from the other stack's resources.

Answer

Use a nested stack to include the security group resources in the same template.

Answer

Use Fn::Ref to reference the security group IDs directly.

Question 12

A developer is creating an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message only once. Which SQS queue type should the developer use?

Accepted Answer

FIFO queue. Amazon SQS FIFO (First-In-First-Out) queues guarantee exactly-once processing within a message group. They use a deduplication ID (either content-based or explicitly provided) to prevent duplicate message delivery, ensuring that each message is processed only once by the consumer.

Answer

Amazon SQS does not support exactly-once processing.

Answer

Dead-letter queue

Answer

Standard queue

Question 13

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL database. Recently, the application started experiencing frequent database connection timeouts. The development team discovered that the application is not closing database connections properly, leading to exhausted database connections. The team wants a solution that does not require code changes. Which option should they choose?

Accepted Answer

Configure Amazon RDS Proxy in front of the RDS instance and update the application to connect through the proxy.. Amazon RDS Proxy provides connection pooling, allowing the application to reuse database connections efficiently, reducing the number of open connections without code changes. Option B is incorrect: Multi-AZ provides high availability and failover but does not address connection leaks or exhaustion. Option C is incorrect: Migrating to Aurora with Auto Scaling for read replicas adds scalability for read traffic but does not fix connection leaks; it also requires migration effort. Option D is incorrect: Increasing max_connections may temporarily alleviate the symptom but does not solve the underlying issue of connections not being closed, and it can lead to resource contention.

Answer

Enable Multi-AZ on the RDS instance to handle failover and reduce connection timeouts.

Answer

Migrate the database to Amazon Aurora and enable Auto Scaling for read replicas.

Answer

Increase the max_connections parameter in the RDS parameter group to allow more concurrent connections.

Question 14

An organization uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. The build process needs to run integration tests that require a MySQL database. The team wants to ensure the database is provisioned only during the build and cleaned up afterward to minimize costs. What is the most efficient solution?

Accepted Answer

Use a Docker container running MySQL within the CodeBuild environment.. Running MySQL inside a Docker container within the CodeBuild environment is the most efficient solution because the database is ephemeral, starts and stops with the build, and incurs no persistent infrastructure cost. CodeBuild supports Docker via the privileged mode setting, and the container can be started in the buildspec's pre_build phase and torn down automatically when the build finishes. This satisfies the requirement to provision only during the build and clean up afterward.

Answer

Provision a small RDS MySQL instance and keep it running for the build process.

Answer

Use AWS CloudFormation to create an RDS instance at the start of the build and delete it at the end.

Answer

Use Amazon DynamoDB as a substitute for MySQL for the integration tests.

Question 15

A developer is working on an application that uses Amazon SQS as a message queue. The application polls the queue using long polling with a wait time of 20 seconds. Recently, the team noticed that messages are being processed multiple times. The application is idempotent, but duplicate processing is causing unnecessary costs. What should the developer do to reduce duplicate message processing?

Accepted Answer

Use a DynamoDB table to track processed message IDs and ignore duplicates.. SQS standard queues provide at-least-once delivery, so duplicates are expected. Since the application is already idempotent, the developer should track processed message IDs in a DynamoDB table (with conditional writes or TTL) and skip messages already processed. This reduces redundant processing and cost without changing the queue type.

Answer

Switch to a FIFO queue to enable exactly-once processing.

Answer

Increase the visibility timeout to a value greater than the maximum processing time.