DVA-C02 Development with AWS Services Practice Test 4 — 15 Questions

Question 1

A company uses AWS CodeBuild to run unit tests. The buildspec.yml file is stored in the source repository. The build fails intermittently with 'command not found' for a tool that is installed in the build environment. What should the developer do to ensure the tool is available?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the build environment to include the tool via the AWS Management Console.. In AWS CodeBuild curated standard images, multiple runtimes (such as Node.js, Python, Go, Java, etc.) are pre-installed. However, to use these tools, you must explicitly specify the runtime version in the `runtime-versions` section of the `install` phase in the `buildspec.yml` file. If the runtime version is not specified, the environment will not initialize the paths for those tools, resulting in a 'command not found' error.

Answer

Use a custom Docker image that includes the tool.

Answer

Add a post_build phase to install the tool.

Answer

Add a pre_build phase to install the tool.

Question 2

A developer is deploying a web application using AWS Elastic Beanstalk. The application needs to store session state. Which THREE services can be used for session state storage? (Choose THREE.)

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis, Amazon DynamoDB, and Amazon RDS can all be used to store session state:

- **Amazon ElastiCache for Redis** is an in-memory key-value store that provides sub-millisecond latency, making it an ideal and highly performant choice for session state management.
- **Amazon DynamoDB** is a fully managed NoSQL database that scales seamlessly and offers single-digit millisecond latency. It is widely used for session state storage (e.g., via the DynamoDB Session State Provider).
- **Amazon RDS** is a managed relational database service. While less performant than ElastiCache or DynamoDB, relational databases are frequently used to store session state (especially in legacy or traditional web applications migrating to AWS).

Amazon S3 is an object storage service and is not suitable for session state due to higher latency for frequent, small read/write operations. Amazon CloudFront is a content delivery network (CDN) used for caching content at edge locations, not for storing application session state.

Answer

Amazon S3

Answer

Amazon CloudFront

Question 3

A developer is using Amazon S3 to store sensitive data. The compliance team requires that all objects be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). Which THREE steps must the developer take to enforce this requirement? (Choose THREE.)

Accepted Answer

Create an AWS KMS customer-managed key.. SSE-KMS requires a customer-managed AWS KMS key to encrypt objects at rest. By creating a customer-managed key, the developer gains control over key rotation, access policies, and audit trails, which satisfies the compliance team's requirement for server-side encryption with a customer-managed key.

Answer

Configure the bucket ACL to require encryption.

Answer

Enable S3 default encryption with SSE-S3.

Question 4

A developer runs the command above. The output.txt file is empty. What could be the reason?

Accepted Answer

The Lambda function did not return any output.. When invoking an AWS Lambda function using the AWS CLI `lambda invoke` command, specifying `--invocation-type Event` tells Lambda to invoke the function asynchronously. In this mode, Lambda queues the event and immediately returns a `202 Accepted` status code with no response payload. Consequently, the output file (`output.txt`) remains empty (0 bytes). If it were a synchronous invocation (`RequestResponse`) and the function returned nothing, the output file would contain `null` rather than being completely empty.

Answer

The payload is not valid JSON.

Answer

The Lambda function timed out.

Answer

The function name is incorrect.

Question 5

A developer attaches this IAM policy to a user. The user tries to upload an object to example-bucket without specifying encryption. What will happen?

Accepted Answer

The upload fails with an access denied error.. The question stem refers to 'this IAM policy' but does not provide the policy document. We must include the IAM policy in the stem. To align with the explanation, the policy should use 'StringNotEqualsIfExists' so that a missing encryption header triggers the Deny effect.

Answer

The upload succeeds only if the object is smaller than 5 GB.

Answer

The upload succeeds but the object is not encrypted.

Answer

The upload succeeds because S3 default encryption is applied.

Question 6

A developer deploys this CloudFormation template. The Lambda function fails to access the DynamoDB table 'MyTable'. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks DynamoDB permissions.. The Lambda function requires an IAM execution role with permissions to perform DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem) on the 'MyTable' table. Without these permissions, the SDK call to DynamoDB will fail with an AccessDeniedException, even if the template deploys the table and function correctly.

Answer

The runtime nodejs18.x is incorrect for this handler.

Answer

The S3 bucket 'my-bucket' does not exist.

Answer

The environment variable TABLE_NAME is misspelled.

Question 7

A developer is using AWS CodePipeline to automate a build and deploy process. The pipeline has a build stage that uses AWS CodeBuild and a deploy stage that uses AWS CodeDeploy. The build stage produces a build artifact that is stored in Amazon S3. The deploy stage fails with 'NoSuchKey' error. What is the MOST likely cause?

Accepted Answer

The CodeDeploy application does not have the correct service role.. The stem states that 'The build stage produces a build artifact that is stored in Amazon S3.' This directly contradicts Option C, which claims no OutputArtifact is configured. Furthermore, CodePipeline validation prevents creating or running a pipeline where a CodeDeploy action lacks a matching input/output artifact. According to AWS documentation, a 'NoSuchKey' error during CodeDeploy deployment (when the artifact actually exists in S3) is typically caused by the CodeDeploy service role or EC2 instance profile lacking permissions to access the S3 bucket or decrypt the KMS key, making Option A the correct answer.

Answer

The CodeBuild project does not have permissions to upload to the S3 bucket.

Answer

The pipeline does not have an OutputArtifact configured for the build stage, so the artifact is not passed to the deploy stage.

Answer

The S3 bucket policy does not allow CodePipeline to access the artifact.

Question 8

A company is developing a microservices architecture using Amazon ECS with Fargate launch type. Each microservice needs to store sensitive configuration data such as database passwords. The company wants to avoid storing secrets in the application code or environment variables. What is the MOST secure and recommended approach?

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store and retrieve secrets.. AWS Systems Manager Parameter Store (or Secrets Manager) is designed for secure storage of secrets and can be accessed via IAM roles. Option A is wrong because environment variables can be exposed. Option B is wrong because S3 is not designed for secrets and requires encryption management. Option D is wrong because Lambda is a compute service, not a secret store.

Answer

Pass secrets as environment variables in the task definition.

Answer

Store secrets in an encrypted S3 bucket and have the application download them at startup.

Answer

Use an AWS Lambda function to generate secrets and store them in DynamoDB.

Question 9

A developer is using AWS Lambda with Amazon API Gateway to build a REST API. The Lambda function is written in Node.js and uses the 'aws-sdk' to interact with DynamoDB. When the function is invoked, it consistently takes more than 10 seconds to complete, causing API Gateway to timeout (default timeout is 29 seconds). The developer wants to reduce latency. What should the developer do FIRST?

Accepted Answer

Increase the Lambda function timeout in the function configuration.. By default, the AWS SDK for JavaScript (v2) in Node.js does not reuse TCP connections, meaning a new TCP handshake is performed for every single DynamoDB request. This adds significant latency to functions making multiple sequential calls. Setting the environment variable `AWS_NODEJS_CONNECTION_REUSE_ENABLED` to `1` instructs the SDK to reuse connections (HTTP keep-alive), which drastically reduces latency.

Answer

Switch from DynamoDB to Amazon RDS for faster queries.

Answer

Attach an IAM role to the Lambda function to speed up DynamoDB access.

Answer

Enable provisioned concurrency on the Lambda function to reduce cold starts.

Question 10

A developer is designing a serverless application using AWS Lambda. The function needs to process messages from an Amazon SQS queue. The developer wants to configure the Lambda function to be triggered by the SQS queue. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Attach an IAM execution role to Lambda with permission to receive messages from SQS.. The Lambda function needs an IAM execution role with permissions to call the SQS ReceiveMessage, DeleteMessage, and GetQueueAttributes actions. Without these permissions, the Lambda service cannot poll messages from the queue. Option C is correct because an event source mapping is required to connect the SQS queue to the Lambda function; this mapping defines the polling configuration, batch size, and concurrency settings.

Answer

Configure a resource-based policy on the SQS queue to allow Lambda invocation.

Answer

Set up a dead-letter queue for failed messages.

Answer

Place the Lambda function in a VPC to access the SQS queue.

Question 11

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. The developer wants to implement caching to improve performance. Which THREE steps are necessary to enable caching for a specific stage? (Choose THREE.)

Accepted Answer

Enable API caching in the stage settings.. API Gateway provides built-in caching at the stage level, which can be enabled directly in the stage settings without modifying the Lambda function or adding external services. This caching reduces the number of calls made to the backend Lambda function by serving cached responses for identical requests, improving performance and reducing latency.

Answer

Attach an IAM policy to the API Gateway role for cache access.

Answer

Modify the Lambda function to store responses in ElastiCache.

Question 12

A developer is building a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to ensure that a manual approval step is required before deploying to production. Which THREE components must be configured? (Choose THREE.)

Accepted Answer

Set up an Amazon SNS topic to notify approvers of pending approval.. Amazon SNS is used to send notifications to approvers when a manual approval action is pending in the pipeline. The approval action in CodePipeline can be configured with an SNS topic ARN, and when the pipeline reaches that stage, it publishes a notification to the topic, alerting approvers to review and approve or reject the deployment.

Answer

Create an AWS Lambda function to process approval logic.

Answer

Configure Amazon CloudWatch Events to trigger the approval step.

Question 13

The above CLI output shows the versioning status of an S3 bucket. A developer wants to enable MFA Delete on the bucket. What should the developer do?

Accepted Answer

Use the aws s3api put-bucket-versioning command with the --mfa parameter.. The `aws s3api put-bucket-versioning` command with the `--mfa` parameter is the correct way to enable MFA Delete on an S3 bucket. The `--mfa` parameter supplies the MFA token (serial number + code) required for this high-security operation, as MFA Delete can only be toggled by the bucket owner using multi-factor authentication.

Answer

Use the aws s3api put-bucket-acl command with MFA token.

Answer

Enable Object Lock on the bucket, which automatically enables MFA Delete.

Answer

Use the aws s3api put-bucket-policy command to require MFA.

Question 14

The above IAM policy is attached to an IAM role used by a Lambda function. The function tries to scan the table 'MyTable' but receives an AccessDenied error. What is the MOST likely cause?

Accepted Answer

The policy does not include the 'dynamodb:Scan' action.. The IAM policy shown in the question does not include the 'dynamodb:Scan' action. Without this action explicitly allowed, the Lambda function's role lacks permission to perform a Scan operation on the DynamoDB table, resulting in an AccessDenied error. The policy must grant the specific action required by the API call.

Answer

The DynamoDB table does not exist.

Answer

The IAM role is not attached to the Lambda function.

Answer

The resource ARN is incorrect.

Question 15

An AWS CLI command invokes a Lambda function. The response includes 'FunctionError': 'Handled'. What does this indicate?

Accepted Answer

The function threw an exception that was caught and returned as an error.. An AWS CLI command invokes a Lambda function. The response includes 'FunctionError': 'Handled'. What does this indicate?

Answer

The function had a permission error.

Answer

The function executed successfully.

Answer

The function timed out.