DVA-C02 Development with AWS Services Practice Test 4 — 15 Questions

Question 1

Which TWO IAM policy conditions can be used to enforce multi-factor authentication (MFA) for API calls?

Accepted Answer

Condition: { "Null": { "aws:MultiFactorAuthPresent": "false" } }. Option A is correct because the Null condition with aws:MultiFactorAuthPresent set to "false" evaluates to true when the key is absent, which is the standard pattern for denying access to API calls that were not authenticated with MFA (the key is only present for MFA-authenticated sessions). Option E is correct because the Bool condition with aws:MultiFactorAuthPresent set to "true" directly checks that the request was made with MFA, and it is the canonical condition used in Allow or Deny statements to enforce MFA for API calls. Options B, C, and D are not valid for this purpose: iam:MFADeviceType is not a supported IAM condition key for evaluating MFA presence, aws:SourceIdentity merely carries the source identity set during authentication and does not indicate MFA, and iam:ResourcePath is not a real IAM condition key for MFA enforcement.

Answer

Condition: { "StringLike": { "iam:MFADeviceType": "Virtual" } }

Answer

Condition: { "ForAllValues:StringEquals": { "aws:SourceIdentity": "admin" } }

Answer

Condition: { "StringEquals": { "iam:ResourcePath": "/" } }

Question 2

A company is deploying a microservices architecture on Amazon ECS. Each service needs to store secrets such as database passwords. Which service should be used to securely inject these secrets into containers?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager and AWS Systems Manager Parameter Store are both natively integrated with Amazon ECS for injecting sensitive data into containers as environment variables or log configuration options. To make AWS Secrets Manager the uniquely correct answer, the stem must specify a requirement that only Secrets Manager supports, such as automatic rotation of database credentials.

Answer

Amazon Elastic File System (EFS)

Answer

Amazon S3

Answer

AWS Systems Manager Parameter Store

Question 3

Refer to the exhibit. A developer ran the AWS CLI command to invoke a Lambda function. The response indicates an error. What should the developer do to see the error details?

Accepted Answer

Read the output.txt file for the error message.. When invoking a Lambda function via the AWS CLI using `aws lambda invoke`, the command requires an output file parameter (e.g., `output.txt`). If the function execution fails, the CLI response payload containing the error message, error type, and stack trace is written directly to this output file. Reading the output file is the correct and most direct way to view these error details.

Answer

Decode the LogResult value from base64 to see the logs.

Answer

Check CloudWatch Logs for the function's log group.

Answer

Increase the Lambda function timeout to avoid the error.

Question 4

A company uses AWS CloudFormation to deploy infrastructure. A developer needs to update a stack that includes an RDS DB instance. The update requires modifying the DB instance's DB engine version. Which THREE strategies can the developer use to minimize downtime during the update?

Accepted Answer

Update the stack directly by modifying the DB engine version property in the template.. Option B is correct because CloudFormation supports updating the DBEngineVersion property of an AWS::RDS::DBInstance resource, and for minor version upgrades RDS can apply the change in place with minimal disruption during the maintenance window. Option C is correct because RDS Blue/Green Deployments provision a fully synchronized staging environment with the new engine version, then perform a fast switchover (typically under a minute), which is the AWS-recommended approach for minimizing downtime during engine version changes. Option E is correct because creating a read replica on the new engine version, letting it catch up, promoting it to primary, and repointing the stack (e.g., via the DBInstanceIdentifier or endpoint reference) achieves a controlled cutover with very short write downtime. Option A is not correct in this context because the question is about updating a CloudFormation-managed stack; running modify-db-instance directly causes drift from the template and does not satisfy the stack update requirement. Option D is not correct because deleting and recreating the stack destroys the existing DB instance and its data, causing maximum downtime rather than minimizing it.

Answer

Use the RDS modify-db-instance command to upgrade the engine version in-place.

Answer

Delete the current stack and create a new stack with the new engine version.

Question 5

A developer is deploying an application using AWS CodeDeploy with an in-place deployment configuration. The application runs on an EC2 instance behind an Application Load Balancer. The deployment fails because the health check fails after the new version is installed. What should the developer do to prevent the deployment from failing due to health checks?

Accepted Answer

Configure a longer health check grace period in the CodeDeploy application specification.. Configuring a longer health check grace period in the CodeDeploy application specification allows the application to start and stabilize before the load balancer checks its health, preventing premature failure. Option A is incorrect because deregistering and re-registering the instance is manual and not a built-in CodeDeploy feature; it also disrupts traffic. Option B is wrong because blue/green deployment is a different strategy, but the question asks about in-place deployment. Option D is incorrect because increasing the health check interval does not provide a grace period; it only makes checks less frequent, which may still fail if the app takes time to start.

Answer

Deregister the instance from the target group before deployment and register it after.

Answer

Switch to a blue/green deployment strategy.

Answer

Increase the health check interval on the load balancer.

Question 6

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API should allow users to retrieve data from an Amazon DynamoDB table. The developer wants to minimize latency for frequently accessed data. What should the developer do?

Accepted Answer

Enable API Gateway caching.. To minimize latency for frequently accessed data in a REST API built with API Gateway and Lambda, enabling API Gateway caching is the most effective solution. When caching is enabled, API Gateway caches the responses from the integration (Lambda) for a specified Time-to-Live (TTL) period. For subsequent requests, API Gateway serves the response directly from the cache without invoking the Lambda function or querying DynamoDB, significantly reducing latency and backend load.

Answer

Deploy a CloudFront distribution in front of the API Gateway.

Answer

Increase the Lambda function memory to improve performance.

Answer

Use DynamoDB Accelerator (DAX) as a caching layer.

Question 7

A developer is troubleshooting an issue where an IAM user is unable to upload a file to an S3 bucket that uses server-side encryption with AWS KMS (SSE-KMS). The IAM policy shown in the exhibit is attached to the user. What is the likely cause of the failure?

Accepted Answer

The user does not have kms:Encrypt permission on the KMS key.. To make this question usable, either an exhibit (image or code block of the IAM policy) must be provided, or the stem must be rewritten to describe the policy directly (e.g., 'The IAM user has an IAM policy that grants s3:PutObject on the bucket, but no KMS permissions are defined...').

Answer

The KMS key ARN in the resource statement is incorrect.

Answer

The user does not have s3:PutObject permission on the bucket.

Answer

The user does not have access to the KMS key at all.

Question 8

A developer is setting up an S3 bucket to trigger an AWS Lambda function when a new object is created. After configuring the event notification, the Lambda function is not invoked. The developer checks the Lambda resource-based policy, which is shown in the exhibit. What is the issue?

Accepted Answer

The policy is missing a condition that specifies the S3 bucket ARN.. First, the question is missing the exhibit showing the Lambda resource-based policy. Second, from a technical standpoint, if a Lambda resource-based policy grants 's3.amazonaws.com' the 'lambda:InvokeFunction' permission without a condition restricting it to a specific bucket ARN, the invocation will still succeed. AWS does not block the invocation; it merely flags it as a security risk (confused deputy). Therefore, the premise that the Lambda function is not invoked because of a missing condition is technically incorrect.

Answer

The Action is incorrect; it should be 'lambda:Invoke' instead of 'lambda:InvokeFunction'.

Answer

The principal is incorrect; it should be the S3 bucket ARN.

Answer

The policy is missing the 'Version' field.

Question 9

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API has a REST endpoint that triggers a Lambda function to write data to an Amazon DynamoDB table. Under high traffic, some requests are failing with 5xx errors. The developer notices that the Lambda function's duration is spiking. Which combination of actions should the developer take to improve performance and reduce errors?

Accepted Answer

Increase the Lambda function's memory and enable DynamoDB auto-scaling.. Increasing the Lambda function's memory allocation also increases CPU and network throughput, which can reduce execution duration and prevent timeouts. Enabling DynamoDB auto-scaling allows the table to handle write capacity bursts, reducing throttling and subsequent 5xx errors. Option A is incorrect because DynamoDB Accelerator (DAX) is a read cache and does not improve write performance. Option B introduces unnecessary latency and does not directly address write capacity. Option D is focused on read performance and does not help with write-intensive workloads.

Answer

Enable DynamoDB Accelerator (DAX) for the table and set a Lambda reserved concurrency.

Answer

Use an Amazon SQS queue as a buffer between API Gateway and Lambda.

Answer

Switch the API endpoint to HTTP API and enable API Gateway caching.

Question 10

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is triggered by the SQS queue. Recently, the function started failing due to timeout errors when processing large messages. The function's timeout is set to the maximum of 15 minutes. What should a developer do to resolve this issue?

Accepted Answer

Decrease the SQS batch size in the Lambda trigger.. When a Lambda function triggered by SQS times out and its timeout is already set to the maximum of 15 minutes, the standard solution is to decrease the batch size (BatchSize) in the event source mapping (Lambda trigger). This reduces the number of messages processed in a single invocation, thereby reducing the execution time per invocation and preventing timeouts. Splitting messages (Option D) is unnecessary and impractical since SQS messages are already limited to 256 KB.

Answer

Increase the SQS queue's visibility timeout.

Answer

Increase the maximum message size in the SQS queue.

Answer

Split the large messages into smaller messages before sending to SQS.

Question 11

A developer is writing a script to programmatically create an Amazon EC2 instance. The script will run on an EC2 instance that already has an IAM role attached. Which AWS SDK method should the developer use to securely obtain temporary credentials for the script?

Accepted Answer

Retrieve the temporary credentials from the instance metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/).. The instance metadata endpoint at http://169.254.169.254/latest/meta-data/iam/security-credentials/ provides temporary, automatically rotated credentials for the IAM role attached to the EC2 instance. The AWS SDK's default credential provider chain automatically checks this endpoint, but explicitly retrieving from the metadata service is a valid and secure method when you need direct access to the credentials, such as for use with non-AWS tools or custom signing logic.

Answer

Store the access key ID and secret access key in the script.

Answer

Use AWS Secrets Manager to store and retrieve the credentials.

Answer

Use the AWS SDK's default credential provider chain.

Question 12

A company runs a data processing pipeline using AWS Step Functions. The pipeline starts with a task that reads a CSV file from Amazon S3 and then fans out to multiple parallel Lambda functions for data transformation. The final step aggregates the results and writes to an Amazon DynamoDB table. Recently, the pipeline has been failing intermittently with 'StateMachineExecutionLimitExceeded' errors. The development team has already increased the execution history limit to the maximum. The pipeline runs about 500 executions per day. Meanwhile, the operations team reports that some executions are timing out after 5 minutes, even though each Lambda function completes within 30 seconds. The Step Function definition uses a Map state with a max concurrency of 20. The developer needs to fix both issues. Which combination of actions should the developer take? (Choose the BEST option.)

Accepted Answer

Split the pipeline into multiple smaller Step Functions and chain them together.. The 'StateMachineExecutionLimitExceeded' error indicates the account has hit the maximum number of concurrent or open executions, and increasing the execution history limit does not address this — the limit is on execution count, not history size. Splitting the pipeline into multiple smaller Step Functions reduces the number of concurrent executions per state machine and distributes the load, which resolves the execution limit issue. The 5-minute timeouts despite 30-second Lambda functions suggest the Map state's max concurrency of 20 is causing queuing — with many parallel branches, some wait for concurrency slots, and the overall execution exceeds the timeout. Splitting the pipeline also helps here by reducing the fan-out per execution.

Answer

Reduce the max concurrency of the Map state and increase the task execution timeout in the Step Function definition.

Answer

Increase the max concurrency of the Map state and add a retry policy.

Answer

Set a Lambda reserved concurrency for the transformation functions to 100.

Question 13

A developer attached the above IAM policy to an IAM user. The user reports being denied access to objects in the S3 bucket 'my-bucket' from an IP address in the 10.0.0.0/24 range. What is the MOST likely cause?

Accepted Answer

The IP address range 10.0.0.0/24 is a private range not seen by S3.. The `aws:SourceIp` condition key in IAM policies evaluates the source IP address as seen by the AWS service. For S3, the source IP is the public IP address of the client, not any private IP (RFC 1918) such as 10.0.0.0/24. Private IPs are internal to a VPC or local network and are never visible to S3; the service only sees the public IP after NAT or internet gateway translation. Therefore, the condition will never match, effectively denying all requests from that private range.

Answer

The Resource ARN is missing the bucket name.

Answer

The bucket policy also denies access.

Answer

The condition should use 'aws:VpcSourceIp' instead.

Question 14

A developer runs the above AWS CLI command to invoke a Lambda function. The response shows StatusCode 200 but FunctionError is 'Unhandled'. What does this indicate?

Accepted Answer

The function code threw an unhandled exception.. The stem has been updated to refer to 'the `aws lambda invoke` command' instead of 'the above AWS CLI command' to ensure the question is self-contained and clear.

Answer

The function timed out.

Answer

The payload was malformed and the function did not run.

Answer

The function lacks execution permissions.

Question 15

A developer needs to store a small amount of session state data (less than 1 MB) for a web application running on EC2. The data must be shared across multiple instances. Which solution is MOST cost-effective?

Accepted Answer

Use Amazon DynamoDB to store session data.. Amazon DynamoDB is the most cost-effective and scalable solution for storing session state data. Because DynamoDB is serverless, you can use On-Demand capacity mode to pay only for the requests you make, or leverage the generous Free Tier (25 GB of storage and 25 WCU/RCU). In contrast, Amazon ElastiCache requires provisioning dedicated cache nodes which incur a continuous hourly cost even when underutilized, making it less cost-effective for small amounts of data.

Answer

Use an Amazon EBS volume with multi-attach.

Answer

Use Amazon ElastiCache for session state.

Answer

Store session data in Amazon S3.