DVA-C02 Development with AWS Services Practice Test 4 — 15 Questions

Question 1

A developer is using Amazon API Gateway with a Lambda authorizer to control access to an API. The authorizer function needs to decode a JWT token from the request header and return an IAM policy. Which type of Lambda authorizer should be used?

Accepted Answer

TOKEN authorizer with the token passed in the Authorization header.. A TOKEN authorizer is designed to receive a JWT or OAuth token in the Authorization header and pass it directly to the Lambda function for validation. The Lambda function then decodes the token and returns an IAM policy document to allow or deny the API request. This is the correct choice because the question explicitly states the token is in the request header and needs to be decoded, which matches the TOKEN authorizer's behavior of forwarding the raw token value.

Answer

REQUEST authorizer with the token in a custom header.

Answer

Use Amazon Cognito User Pools as the authorizer.

Answer

Use a resource policy to allow or deny access based on the JWT token.

Question 2

A developer is building a serverless application that needs to process messages from an Amazon SQS queue and store the results in an Amazon DynamoDB table. Which AWS service should the developer use to orchestrate the processing logic without managing servers?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that can be triggered by SQS messages via event source mappings, process each message, and write results to DynamoDB without provisioning or managing any servers. The developer simply uploads the processing code, and Lambda handles scaling, concurrency, and execution, making it ideal for this event-driven, serverless workflow.

Answer

Amazon Elastic Container Service (ECS) with Fargate

Answer

Amazon EC2 instances with a custom application

Answer

AWS Step Functions

Question 3

A developer is building a REST API using Amazon API Gateway and wants to validate the incoming request body against a JSON schema before passing the request to the backend Lambda function. Which API Gateway feature should the developer use?

Accepted Answer

Request validation. API Gateway's request validation feature allows you to define a JSON schema (using JSON Schema Draft 4) for the request body and automatically reject requests that do not conform before they reach the backend. This offloads validation from the Lambda function, reducing cold start overhead and ensuring only valid payloads are processed. The developer can configure this in the API Gateway console or via the OpenAPI specification.

Answer

Mapping templates

Answer

Integration request

Answer

Stage variables

Question 4

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API will be consumed by a web application hosted on a different domain. The developer needs to enable Cross-Origin Resource Sharing (CORS) for all HTTP methods. What is the most efficient way to achieve this?

Accepted Answer

Enable CORS on the API Gateway resource using the 'Enable CORS' feature in the API Gateway console, which adds the OPTIONS method and appropriate headers.. Option A is correct because API Gateway's 'Enable CORS' feature automatically creates an OPTIONS method for the selected resource and configures the necessary response headers (e.g., Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to handle preflight requests. This is the most efficient approach as it centralizes CORS configuration at the API Gateway layer, eliminating the need for manual header management in Lambda or additional infrastructure.

Answer

In the Lambda function code, add the 'Access-Control-Allow-Origin' header to every response.

Answer

Configure Amazon CloudFront in front of API Gateway to handle CORS.

Answer

Set a bucket policy on the S3 bucket that hosts the web application to allow cross-origin requests.

Question 5

A developer has an Amazon S3 bucket containing private user documents. The application must generate a time-limited URL for users to download their own documents without requiring the users to have AWS credentials. Which solution should the developer use?

Accepted Answer

Create a pre-signed URL for each object using the AWS SDK with an appropriate expiration time.. Pre-signed URLs allow temporary, time-limited access to private S3 objects without requiring the user to have AWS credentials. The developer generates the URL server-side using the AWS SDK, embedding an expiration time, and the user can download the object directly via HTTP GET. This meets the requirement of granting ephemeral access to specific documents for unauthenticated users.

Answer

Use CloudFront signed URLs with an origin access identity (OAI) to restrict access to the S3 bucket.

Answer

Set a bucket policy that allows public read access for the specific users based on their IP addresses.

Answer

Provide the users with IAM user credentials that have read access to the bucket.

Question 6

A developer is building a microservices application that processes event messages from multiple sources. The application requires at-least-once delivery, but message ordering is not important. Which Amazon SQS queue type should the developer use?

Accepted Answer

Standard queue. Amazon SQS Standard queues provide at-least-once delivery and best-effort ordering, making them ideal for microservices that can tolerate duplicate messages and do not require strict message sequencing. Since the application processes events from multiple sources and message ordering is not important, a Standard queue meets the requirements without the throughput limitations of FIFO queues.

Answer

FIFO queue

Answer

Dead-letter queue

Answer

Delay queue

Question 7

A developer is building an AWS Lambda function that needs to retrieve a database password securely. The password is stored in AWS Secrets Manager and is rotated every 30 days. The function must minimize the number of API calls to Secrets Manager. Which approach should the developer use?

Accepted Answer

Retrieve the secret from Secrets Manager once outside the handler function, cache it in a global variable, and refresh the cache if the secret fails.. Option C is correct because it retrieves the secret once during the Lambda cold start (outside the handler), caches it in a global variable, and only refreshes the cache if the secret fails (e.g., due to rotation). This minimizes API calls to Secrets Manager while still handling secret rotation gracefully, as the cached secret remains valid until a failure occurs.

Answer

Store the database password as an encrypted environment variable in the Lambda function.

Answer

Call Secrets Manager on every invocation to get the latest secret.

Answer

Use AWS Systems Manager Parameter Store SecureString instead of Secrets Manager.

Question 8

A developer configures an AWS Lambda function to process image files uploaded to an S3 bucket. The bucket receives a mix of .jpg, .png, and .pdf files. The developer wants to invoke the Lambda function only for image files to reduce costs. Which configuration should the developer use?

Accepted Answer

Configure an S3 event notification with a suffix filter '.jpg' and '.png'. Option B is correct because S3 event notifications support suffix filtering, allowing you to specify object key suffixes like '.jpg' and '.png'. This ensures the Lambda function is invoked only when objects with those extensions are uploaded, filtering out .pdf files and reducing unnecessary invocations and costs.

Answer

Configure an S3 event notification with a prefix filter 'images/'

Answer

Create a Lambda resource-based policy that denies invocation from S3 for .pdf objects

Answer

Add an S3 bucket policy that denies PutObject for any object that is not a .jpg or .png

Question 9

A developer is designing a REST API using Amazon API Gateway that experiences high traffic with many repeated requests for the same data. The developer wants to reduce backend load and improve response times. Which feature should the developer enable on the API Gateway method?

Accepted Answer

Enable API Gateway caching. API Gateway caching stores responses from backend endpoints for a configurable Time-to-Live (TTL). When a request for the same data arrives, API Gateway serves the cached response directly without invoking the backend, reducing load and improving latency. This is the most straightforward and managed solution for repeated requests at the API layer.

Answer

Implement caching in the Lambda function using a local cache

Answer

Use an Amazon ElastiCache Redis cluster and modify the Lambda function to check the cache first

Answer

Place an Amazon CloudFront distribution in front of API Gateway

Question 10

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API should return JSON responses to client requests. The developer is using the Lambda proxy integration. What is the simplest way to return a JSON response from the Lambda function?

Accepted Answer

Return a dictionary containing 'statusCode', 'headers', and 'body' with 'body' as a JSON string.. With Lambda proxy integration, API Gateway passes the entire request to the Lambda function and expects the function to return a specific response format. The simplest way to return a JSON response is to return a dictionary (or object) containing 'statusCode', 'headers', and 'body', where 'body' is a JSON string. This format is required by API Gateway to correctly interpret the Lambda output and forward it to the client.

Answer

Return a string from the Lambda handler.

Answer

Use API Gateway integration response and mapping templates to transform the Lambda output.

Answer

Return a JSON object from Lambda and set a Content-Type header in the API Gateway method response.

Question 11

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The application needs to store and retrieve session data. The session data has a TTL of 30 minutes. Which DynamoDB feature should the developer use to automatically delete expired items?

Accepted Answer

Use DynamoDB Time to Live (TTL) to set an expiry time attribute that DynamoDB automatically deletes when the TTL is reached.. DynamoDB Time to Live (TTL) is the correct feature because it allows you to define a per-item timestamp attribute. When that timestamp is reached, DynamoDB automatically deletes the item without any additional cost or custom code. This directly meets the requirement to automatically delete expired session data after 30 minutes.

Answer

Use DynamoDB Streams to capture expired items and trigger a Lambda function for deletion.

Answer

Use DynamoDB Global Tables to replicate data to another region and then set a TTL on the replica.

Answer

Use DynamoDB Accelerator (DAX) to cache the data and expire it based on a cache TTL.

Question 12

A developer is creating a new DynamoDB table to store order data. The orders have a unique order ID and are retrieved by order ID. Occasionally, the developer needs to query orders by customer ID. Which design approach would minimize costs and provide the fastest queries?

Accepted Answer

Use the order ID as the partition key and create a global secondary index on customer ID. Option A is correct because using the order ID as the partition key ensures the most efficient primary key access for the primary query pattern (retrieving by order ID). Creating a Global Secondary Index (GSI) on customer ID allows efficient querying by customer ID without scanning the base table, and GSIs have separate read/write capacity from the base table, so you only pay for the index when it is used. This design minimizes costs by avoiding unnecessary scans and provides the fastest queries for both access patterns.

Answer

Use the customer ID as the partition key and order ID as the sort key

Answer

Use the order ID as the partition key and scan the table for customer ID queries

Answer

Use the customer ID as the partition key and create a local secondary index on order ID

Question 13

A developer is writing an AWS Lambda function that processes files uploaded to an S3 bucket. The function should only be triggered when a new object is created in a specific subfolder (e.g., /uploads/). Which S3 event notification configuration should the developer use?

Accepted Answer

Configure the event notification with a prefix filter set to 'uploads/' and event type 's3:ObjectCreated:*'.. Option A is correct because S3 event notifications support prefix filtering, which allows you to specify a key prefix (e.g., 'uploads/') so that only object creation events in that subfolder trigger the Lambda function. By setting the event type to 's3:ObjectCreated:*', the function responds to all object creation operations (PUT, POST, Copy, etc.) within the filtered path, meeting the requirement precisely without unnecessary invocations.

Answer

Configure a single event notification for all objects and filter on the prefix inside the Lambda function.

Answer

Configure the event notification using object tags to filter events.

Answer

Use AWS CloudTrail to detect S3 PutObject events and trigger Lambda.

Question 14

A developer is building a serverless application that uses Amazon DynamoDB. The application needs to retrieve an item by its primary key frequently. Which DynamoDB API call should the developer use to achieve the lowest latency?

Accepted Answer

GetItem. The GetItem API call is the most efficient way to retrieve a single item by its primary key in DynamoDB, as it directly accesses the item using the hash key (and optionally the sort key) with consistent, single-digit millisecond latency. Unlike Scan or Query, GetItem does not need to evaluate any conditions or filter through other items, making it the lowest-latency option for this specific use case.

Answer

Scan

Answer

Query

Answer

BatchGetItem

Question 15

A developer is storing application configuration data in DynamoDB. The data is frequently accessed by partition key, and items are small (less than 1KB). The read traffic is consistent and predictable. Which read capacity mode is most cost-effective for this workload?

Accepted Answer

Provisioned with fixed capacity. Provisioned with fixed capacity is the most cost-effective option for this workload because the read traffic is consistent and predictable, and items are small (less than 1KB). With fixed provisioned capacity, you pay a flat hourly rate for a set number of read capacity units (RCUs), avoiding the per-request premium of on-demand mode or the overhead of auto scaling. Since the workload does not require elasticity, fixed capacity minimizes cost while ensuring sufficient throughput.

Answer

On-demand

Answer

Provisioned with auto scaling

Answer

Provisioned with reserved capacity