DVA-C02 Development with AWS Services Practice Test 5 — 15 Questions

Question 1

A developer is creating a CI/CD pipeline for a serverless application using AWS CodePipeline. The application includes Lambda functions and an API Gateway REST API. The pipeline should automatically deploy changes when code is pushed to a Git repository. Which THREE actions are required to set this up? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation with a template to deploy the infrastructure.. Option A is correct because AWS CloudFormation is the standard infrastructure-as-code service for defining and provisioning the Lambda functions and API Gateway REST API that make up the serverless application, and CodePipeline can invoke CloudFormation actions to deploy those resources. Option B is correct because CodeCommit is a fully managed Git repository that can serve as the source stage of the pipeline, triggering the pipeline automatically when code is pushed. Option E is correct because CodeBuild is the build stage service that runs unit tests and packages the application artifacts (for example, producing the deployment package or template artifacts) before deployment. Option C is not required because CodeStar is only an optional project dashboard/orchestration convenience and is not a necessary component of a CodePipeline setup. Option D is not appropriate because CodeDeploy does not natively deploy Lambda functions; serverless deployments are handled via CloudFormation, SAM, or the Lambda APIs rather than CodeDeploy.

Answer

Use AWS CodeStar to create a project dashboard.

Answer

Use CodeDeploy to deploy the application to Lambda.

Question 2

A company is running a containerized application on Amazon ECS with Fargate. The application needs to process messages from an Amazon SQS queue. The developer must ensure that the application can scale out based on the queue depth. Which THREE steps should the developer take to implement this? (Choose THREE.)

Accepted Answer

Configure an ECS Service Auto Scaling target tracking policy using the SQS queue's ApproximateNumberOfMessagesVisible metric.. Option B is correct because ECS Service Auto Scaling supports target tracking policies that can scale a service based on a custom CloudWatch metric, and the SQS queue's ApproximateNumberOfMessagesVisible metric (published by SQS to CloudWatch) is the standard way to scale out on queue depth. Option C is correct because messages must be deleted after successful processing; otherwise they remain visible after the visibility timeout expires and are redelivered, inflating ApproximateNumberOfMessagesVisible and causing unnecessary scale-out. Option D is correct because the ECS task role must have IAM permissions for sqs:ReceiveMessage, sqs:DeleteMessage, and sqs:GetQueueAttributes so the application can poll, process, and delete messages from the queue. Option A is not relevant because DynamoDB auto scaling addresses database capacity, not SQS-driven ECS task scaling. Option E is not appropriate because an Application Load Balancer distributes HTTP requests to targets and does not deliver or distribute SQS messages to ECS tasks.

Answer

Configure DynamoDB auto scaling for the application's table to handle increased load.

Answer

Register the ECS tasks with an Application Load Balancer target group to distribute messages.

Question 3

A developer needs to implement a serverless API using Amazon API Gateway and AWS Lambda. The API should support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Enable CORS on the API Gateway resource and methods.. Options B and D are correct. Option B is correct because enabling CORS on API Gateway automatically generates the required CORS headers (like Access-Control-Allow-Origin) and handles the OPTIONS preflight request without any Lambda code. Option D is also correct because you can manually configure an OPTIONS method in API Gateway and implement your Lambda function to return the appropriate CORS headers, giving you more control over the response. Option A is incorrect because a custom domain name is not required for CORS; it only provides a custom endpoint. Option C is incorrect because disabling CORS on API Gateway and relying solely on the Lambda function to set headers will not handle the preflight OPTIONS request automatically; you would still need to implement the OPTIONS method. Option E is incorrect because simply adding the header in all Lambda responses does not handle the OPTIONS preflight request, which is required for cross-origin requests.

Answer

Create a custom domain name for the API Gateway and configure the web application to use it.

Answer

Disable CORS on the API Gateway and set the Access-Control-Allow-Origin header in the Lambda function.

Answer

Modify the Lambda function to include the Access-Control-Allow-Origin header in all responses.

Question 4

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest. The developer must implement a solution that uses server-side encryption with AWS KMS managed keys (SSE-KMS). Which TWO steps are required to meet this requirement? (Choose TWO.)

Accepted Answer

Grant the IAM role used by the application the kms:GenerateDataKey permission for the KMS key.. Option A is correct because SSE-KMS requires the caller to obtain a data key from KMS, so the application's IAM role must have kms:GenerateDataKey (and typically kms:Decrypt) permission on the KMS key; without it, S3 cannot perform the KMS encryption on the object. Option E is correct because an S3 bucket policy that denies PutObject when the x-amz-server-side-encryption header is absent enforces that every upload explicitly requests SSE-KMS, satisfying the security team's mandate that all data be encrypted at rest with KMS-managed keys. Option B is incorrect because setting default bucket encryption to SSE-KMS does not by itself require the KMS permissions or enforce the header, and 'disabling override' is not a valid S3 default-encryption setting. Option C is incorrect because the header name is x-amz-server-side-encryption (not x-amz-sse), so the specified header would not trigger SSE-KMS. Option D is incorrect because SSE-S3 uses Amazon S3-managed keys, not AWS KMS managed keys, so it fails the stated requirement.

Answer

Set the default encryption on the S3 bucket to SSE-KMS and disable the option to override it.

Answer

Set the x-amz-sse header to 'aws:kms' when uploading objects.

Answer

Enable default encryption on the S3 bucket with SSE-S3.

Question 5

A developer is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to send messages to all connected clients. Which THREE actions are required to implement this functionality? (Choose THREE.)

Accepted Answer

Use the API Gateway callback URL to post messages to a specific connection.. Option B is correct because API Gateway WebSocket APIs expose a callback URL (the @connections endpoint, e.g., https://{api-id}.execute-api.{region}.amazonaws.com/{stage}/@connections/{connectionId}) that a backend can POST to in order to push a message to a specific connected client. Option C is correct because calling that @connections endpoint requires the Lambda execution role to have IAM permission for the execute-api:ManageConnections action on the API's ARN; without it the POST is rejected with an authorization error. Option D is correct because API Gateway does not provide a built-in broadcast, so the application must persist connection IDs (typically in a DynamoDB table keyed by connectionId) so the Lambda function can look up all active connections and iterate over them to send messages to every client. Option A is not needed because the WebSocket URL is not stored in environment variables; the callback endpoint is derived from the API ID, region, stage, and connection ID. Option E is not a required action for broadcasting: while the connection ID is indeed available in the $connect event, capturing it is only useful in combination with storing it, and the question asks for the actions required to send messages to all clients.

Answer

Store the WebSocket URL in the Lambda function environment variables.

Answer

Extract the connection ID from the event object when a client connects.

Question 6

An IAM policy is attached to an IAM user. The user attempts to upload an object to s3://my-bucket/confidential/report.pdf from an IP address 192.168.1.100. What will happen?

Accepted Answer

The upload fails because the Deny statement blocks the request.. IAM policy evaluation follows an explicit deny priority: any Deny statement overrides any Allow statement when the Deny's condition is met. In this scenario, the Deny statement includes a condition that blocks the request if the source IP is not within a specified range (e.g., 10.0.0.0/8). Since the source IP 192.168.1.100 does not belong to that allowed range, the Deny condition is satisfied, and the Deny takes effect, overriding the Allow statement that grants s3:PutObject on all objects. Therefore, the upload fails.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on all objects in the bucket.

Answer

The upload succeeds because the IP address 192.168.1.100 matches the condition.

Answer

The upload fails because the Deny statement does not have a condition.

Question 7

A company runs a microservices application on Amazon ECS with Fargate. The application consists of three services: frontend, orders, and payments. The frontend service is behind an Application Load Balancer (ALB). The orders service processes requests from frontend and sends messages to the payments service via an Amazon SQS queue. The payments service polls the queue. Recently, during peak hours, the orders service experiences high latency and the SQS queue depth increases significantly. The monitoring shows that the payments service is not keeping up. The company wants to scale the payments service based on the queue depth. The developer has configured an ECS Service Auto Scaling target tracking policy using the SQS queue's ApproximateNumberOfMessagesVisible metric. However, the payments service is not scaling up as expected. What is the most likely cause?

Accepted Answer

The payments service has reached the maximum number of tasks allowed by the service quota.. The most likely cause is that the payments service has reached the maximum capacity limit defined in its Auto Scaling configuration (scalable target). ECS Service Auto Scaling cannot scale beyond the MaxCapacity limit specified in the scalable target, even if the scaling policy's metric indicates that more tasks are needed.

Option A is incorrect because target tracking policies fully support customized metric specifications (custom metrics).

Option B is incorrect because SQS automatically publishes the ApproximateNumberOfMessagesVisible metric to CloudWatch.

Option D is incorrect because polling frequency does not affect the scaling policy's ability to adjust the task count.

Answer

The target tracking policy is not configured correctly because ECS Service Auto Scaling requires a custom metric, and the metric may not have been published yet.

Answer

The SQS queue is not sending the ApproximateNumberOfMessagesVisible metric to CloudWatch.

Answer

The payments service is not configured to poll the SQS queue frequently enough.

Question 8

A developer is building an application that processes user-uploaded images. The application uses Amazon S3 to store the images and AWS Lambda to generate thumbnails. When a user uploads an image to an S3 bucket, an S3 event notification triggers a Lambda function. The Lambda function processes the image and saves the thumbnail to another S3 bucket. The developer notices that sometimes the Lambda function is not triggered after an upload. The developer checks the Lambda function's CloudWatch logs and sees no invocation records for those uploads. The S3 bucket event notification configuration appears correct. What is the most likely cause of this issue?

Accepted Answer

The S3 bucket and the Lambda function are in different AWS regions.. The most likely cause is that the S3 bucket and the Lambda function are in different AWS regions (Option D). S3 event notifications for Lambda are only supported when both the bucket and the function are in the same region. If they are in different regions, the event notification will not trigger the Lambda function, and no invocation records appear in CloudWatch logs. Option A is incorrect because the destination bucket's policy affects thumbnail writes, not the trigger. Option B is incorrect because S3 event notifications are asynchronous invocations, but they are reliably delivered and not typically lost. Option C is incorrect because the Lambda function's execution role permissions affect reading from the source bucket, not the triggering mechanism.

Answer

The destination S3 bucket does not have the correct bucket policy to allow the Lambda function to write thumbnails.

Answer

The S3 event notification is configured as an asynchronous invocation, and the event is lost.

Answer

The Lambda function's execution role does not have permission to read from the S3 bucket.

Question 9

A developer is using AWS CodeCommit as the source repository for a CI/CD pipeline. The developer wants to trigger a build automatically when changes are pushed to a specific branch. Which services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS CodeBuild. Option A (AWS CodeBuild) is correct because CodeBuild can be configured with a webhook on a CodeCommit repository so that pushes to a specified branch automatically start a build, and it supports branch filtering via the webhook's branch filter (e.g., ^main$). Option E (AWS CodePipeline) is correct because a pipeline can use CodeCommit as its source action with a change-detection mechanism (CloudWatch Events/EventBridge) that starts the pipeline execution whenever a change is pushed to the configured branch. Option B (Amazon CloudWatch Events) is not a build service; it can detect the CodeCommit push and route the event, but it does not itself trigger a build, so it is not the requested service. Option C (AWS CodeStar) is a project scaffolding/tooling service that creates and manages pipelines, not the mechanism that triggers a build on a branch push. Option D (AWS CodeDeploy) is a deployment service that deploys applications to EC2, Lambda, or on-premises instances and has no build-triggering capability for CodeCommit pushes.

Answer

Amazon CloudWatch Events

Answer

AWS CodeStar

Answer

AWS CodeDeploy

Question 10

Refer to the exhibit. A developer created the CloudFormation template snippet. After deployment, the developer uploads a file to the bucket, but the Lambda function is not invoked. What is the MOST likely cause?

Answer

The bucket has a bucket policy that denies s3:PutObject for the IAM user.

Answer

The bucket has versioning enabled, which blocks event notifications.

Answer

The lifecycle rule moves objects to Glacier before the notification is sent.

Answer

The Lambda function returned an error, so the invocation failed silently.

Question 11

A company is using Amazon DynamoDB as the database for a web application. The application reads and writes items based on a primary key. The traffic pattern shows that reads are 10 times more frequent than writes. The development team wants to reduce read latency and costs. They are considering adding a cache layer. The data is not sensitive, but stale data is acceptable for up to 5 minutes. The application runs on EC2 instances. What should the team do to implement caching?

Accepted Answer

Set up an Amazon ElastiCache Memcached cluster and update the application to check the cache before reading from DynamoDB.. ElastiCache for Memcached provides a simple, horizontally scalable in-memory cache that the application can query before hitting DynamoDB, and it supports TTL-based expiration so stale data is acceptable for up to 5 minutes. It is the most cost-effective and operationally simple choice for this read-heavy, non-sensitive workload.

Answer

Use Amazon DynamoDB Accelerator (DAX) as a caching layer.

Answer

Store frequently accessed items in an S3 bucket and read from S3.

Answer

Use Amazon CloudFront to cache responses from the application.

Question 12

A developer attached the above IAM policy to an IAM user. The user tries to upload an object to the S3 bucket my-bucket without specifying server-side encryption. What will happen?

Accepted Answer

The upload will be denied because the Deny statement explicitly denies PutObject without AES256 encryption.. The question stem refers to an IAM policy ('the above IAM policy') but no policy is provided in the prompt. The policy JSON must be included in the stem for the question to be answerable.

Answer

The upload will succeed because the Deny statement is redundant.

Answer

The upload will succeed because the Allow statement grants PutObject permission.

Answer

The upload will succeed but the object will be stored without encryption.

Question 13

A Lambda function processes messages from an SQS queue. The function occasionally fails due to network timeouts when calling an external API. The developer wants to retry failed messages automatically. What should the developer do?

Accepted Answer

Configure a dead-letter queue for the SQS queue and set the Lambda function's maximum retries to 2.. When Lambda processes messages from an SQS queue, it polls the queue synchronously. If the Lambda function fails or times out, the message is returned to the queue and retried automatically once the visibility timeout expires. To limit the number of retries and handle failed messages safely, you must configure a Dead-Letter Queue (DLQ) on the SQS queue itself using a redrive policy with a specified 'maxReceiveCount'. Lambda's own retry settings and Lambda-level DLQs only apply to asynchronous invocations, not to SQS event source mappings.

Answer

Enable SQS redrive policy to automatically retry after a failure.

Answer

Configure a dead-letter queue on the Lambda function to capture failed events.

Answer

Increase the Lambda function's timeout to 15 minutes.

Question 14

A developer is writing a Lambda function that processes events from an Amazon Kinesis stream. The function must ensure that records are processed in the order they were received and that each shard is processed by only one instance of the function at a time. How should the developer configure the Lambda function?

Accepted Answer

Set the function's concurrency to the number of shards and enable parallelization factor.. By default, the Amazon Kinesis event source mapping for AWS Lambda processes records sequentially within each shard. It guarantees that records are processed in the order they were received and that only one instance of the Lambda function processes a given shard at any one time. Enabling a parallelization factor (greater than 1) would allow multiple instances of the function to process different batches from the same shard concurrently, which violates the requirement. Setting the reserved concurrency to 1 is a severe anti-pattern because it limits the entire Lambda function to a single concurrent execution across all shards, causing massive processing delays if the stream has multiple shards.

Answer

Set the batch size to 1 and configure the function's reserved concurrency to 1.

Answer

Set the batch size to 100 and enable parallelization factor per shard.

Answer

Use a DynamoDB table to track sequence numbers and enforce ordering.

Question 15

A company has a Node.js application running on an EC2 instance. The application needs to store session state. The developer wants to ensure high availability and scalability by storing session data externally. Which AWS service is BEST suited for this purpose?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the best choice for external session storage because it provides an in-memory data store with sub-millisecond latency, which is critical for session state access in a high-traffic Node.js application. Redis supports data structures like hashes and TTL (time-to-live) for automatic session expiration, and it can be clustered for high availability and scalability, making it ideal for stateless EC2 instances behind a load balancer.

Answer

Amazon DynamoDB

Answer

Amazon S3

Answer

Amazon RDS for MySQL