DVA-C02 Development with AWS Services Practice Test 6 — 15 Questions

Question 1

A developer is reviewing a CloudFormation template that creates an S3 bucket and a Lambda function. The Lambda function's code is stored in the S3 bucket. What is a potential issue with this template?

Accepted Answer

The Lambda function depends on the S3 bucket, but there is no DependsOn clause to ensure the bucket is created first.. When CloudFormation creates the S3 bucket, the bucket is initially empty. Since the Lambda function creation happens in the same deployment and references the bucket, CloudFormation will attempt to retrieve the zip file specified in the `S3Key` property immediately after the bucket is created. Because the zip file has not been uploaded yet, the Lambda creation will fail with a 'NoSuchKey' (or 'Access Denied') error. To resolve this, developers typically use a pre-existing S3 bucket for Lambda deployments, or use inline code (`ZipFile`) for simple functions.

Answer

The Lambda function's role is referenced incorrectly; it should be 'Ref' instead of 'GetAtt'.

Answer

The bucket name 'my-unique-bucket-12345' is not globally unique.

Answer

The bucket must have versioning enabled to store Lambda code.

Question 2

A developer attaches this IAM policy to an IAM user. The user tries to upload an object to the S3 bucket my-bucket from an IP address of 10.0.1.5. What will happen?

Accepted Answer

The upload will fail because the IP address is not within the allowed range.. The stem refers to an IAM policy ('A developer attaches this IAM policy...'), but no policy document is provided in the question. Without the policy document, the question cannot be answered or verified.

Answer

The upload will fail because the bucket policy denies access.

Answer

The upload will succeed because the policy allows s3:PutObject.

Answer

The upload will succeed because the condition is ignored for uploads.

Question 3

A company is using AWS Lambda to process events from an SQS queue. The Lambda function runs for an average of 45 seconds and processes approximately 100 messages per second. The company notices that the Lambda function is being throttled, causing messages to remain in the queue for longer than expected. Which action would MOST effectively reduce throttling?

Accepted Answer

Increase the batch size in the Lambda event source mapping.. With 100 messages per second and an average execution time of 45 seconds, the required concurrency is 100 * 45 = 4,500 concurrent executions (assuming a batch size of 1). Since the default AWS Lambda concurrency limit per region is 1,000, the function will inevitably be throttled. Increasing the reserved concurrency (Option A) cannot exceed the account limit and would not solve the issue. By increasing the batch size in the event source mapping (Option C), each Lambda invocation processes multiple messages, which significantly reduces the number of concurrent executions required to handle the same message volume, thereby effectively eliminating the throttling.

Answer

Increase the reserved concurrency for the Lambda function.

Answer

Increase the number of shards for the SQS queue.

Answer

Configure a Dead Letter Queue for the SQS queue.

Question 4

A developer is using the AWS CLI to upload a large file to S3. The file is 2 GB. The developer uses the following command: aws s3 cp largefile.zip s3://mybucket/. The upload is taking longer than expected. Which change would MOST improve the upload speed?

Accepted Answer

Enable S3 Transfer Acceleration on the bucket and use the --endpoint-url parameter.. S3 Transfer Acceleration (S3TA) is designed to maximize transfer speeds for large objects by routing traffic through Amazon CloudFront's globally distributed edge locations. To use S3 Transfer Acceleration with the AWS CLI, you must first enable it on the S3 bucket and then direct your CLI commands to the accelerated endpoint (e.g., by using the `--endpoint-url` parameter pointing to the `.s3-accelerate.amazonaws.com` endpoint or by enabling `use_accelerate_endpoint` in the CLI configuration).

Answer

Disable multipart upload by setting --no-multipart.

Answer

Increase the multipart upload part size using the --multipart-upload-part-size option.

Answer

Use the aws s3api put-object command instead.

Question 5

A developer needs to store application logs in a highly available and durable storage service. The logs must be retained for 7 years for compliance purposes. The logs are accessed infrequently after the first 30 days. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 Intelligent-Tiering. The most cost-effective, highly available, and durable solution is to store the logs in Amazon S3 Standard for the first 30 days when they are accessed frequently, and then use an S3 Lifecycle policy to transition them to Amazon S3 Glacier Deep Archive for the remaining 7 years. Glacier Deep Archive offers the lowest storage cost in AWS ($0.00099 per GB/month) and is designed for long-term retention of infrequently accessed data. Storing them directly in Glacier Deep Archive (Option B) is incorrect because it would prevent immediate access during the first 30 days. One Zone-IA (Option C) is not highly available as it stores data in a single Availability Zone. S3 Intelligent-Tiering (Option D) is less cost-effective due to monitoring fees and higher storage costs compared to Glacier Deep Archive over a 7-year period.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 One Zone-Infrequent Access

Answer

Amazon S3 Standard

Question 6

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The application must authenticate users using a third-party OAuth 2.0 provider. Which THREE options can the developer use to integrate with the OAuth provider?

Accepted Answer

Use a Lambda authorizer in API Gateway to validate the OAuth token.. Option B is correct because a Lambda authorizer (formerly a custom authorizer) in API Gateway can be configured with a TOKEN authorizer type to receive the caller's OAuth 2.0 bearer token, validate it against the third-party OAuth provider (e.g., by verifying the JWT signature, issuer, and audience), and return an IAM policy that allows or denies access to the API method. Option C is correct because Amazon Cognito User Pools can act as an OAuth 2.0 identity provider, and API Gateway natively integrates with Cognito User Pools as a COGNITO_USER_POOLS authorizer, so the developer can federate or configure the third-party OAuth provider through Cognito and let API Gateway validate the resulting tokens without custom code. Option A is incorrect because API Gateway resource policies are IAM-based access controls for restricting access by source IP, VPC endpoint, or AWS account, not for validating OAuth 2.0 user tokens. Option D is incorrect because IAM authorization expects AWS SigV4-signed requests or IAM credentials, not third-party OAuth tokens, and a custom token service would not integrate with IAM authorization for OAuth 2.0 flows. Option E is incorrect as stated because a plain custom Lambda function invoked before processing is not an API Gateway authorizer; to validate tokens in Lambda you must configure it as a Lambda authorizer (option B), which is the supported integration point.

Answer

Use an API Gateway resource policy to allow only authenticated users.

Answer

Use IAM authorization with a custom token service.

Answer

Implement token validation in a custom Lambda function that is invoked before processing the request.

Question 7

A company is using AWS Elastic Beanstalk to deploy a web application. The environment is running behind a load balancer. The developer needs to ensure that the application logs are centralized and retained for analysis. Which TWO services can be used to collect and store logs from the EC2 instances?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (A) is correct because Elastic Beanstalk EC2 instances can stream their application and system logs to CloudWatch Logs using the CloudWatch agent or the built-in log streaming feature, providing centralized storage and retention for analysis. Amazon S3 (E) is correct because Elastic Beanstalk can be configured to publish instance logs to an S3 bucket, and S3 offers durable, long-term retention suitable for later analysis. AWS X-Ray (B) is incorrect because it is a tracing service for analyzing request paths and latency, not a log collection or storage service. Amazon Kinesis Data Firehose (C) is incorrect because it is a delivery service for streaming data to destinations like S3, Redshift, or Splunk, not a native Elastic Beanstalk log collection and storage mechanism for EC2 instances. AWS CloudTrail (D) is incorrect because it records AWS API activity and account events, not application logs from EC2 instances.

Answer

AWS X-Ray

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Question 8

A developer is deploying a new version of an AWS Lambda function. The deployment failed because the new function code references a layer that is not available. Which AWS CLI command can be used to list all layers associated with the function?

Accepted Answer

aws lambda get-function-configuration --function-name my-function. The `aws lambda get-function-configuration` command returns the configuration details of a Lambda function, including a list of layer ARNs (Amazon Resource Names) associated with the function. This allows the developer to verify which layers are attached and identify any missing or incorrect layer references that caused the deployment failure. Option B has been updated to a plausible but non-existent command to ensure there is only one correct answer.

Answer

aws lambda list-layer-versions --layer-name my-layer

Answer

aws lambda get-function-layers --function-name my-function

Answer

aws lambda list-layers --function-name my-function

Question 9

A developer is creating an Amazon S3 bucket to store sensitive documents. The bucket must encrypt objects at rest using an AWS Key Management Service (KMS) key. Which S3 bucket property should be configured?

Accepted Answer

Default encryption. S3 default encryption can be set to use SSE-KMS. Option A is wrong because bucket policies control access, not encryption. Option C is wrong because versioning is for object versions, not encryption. Option D is wrong because lifecycle configuration manages object lifecycle, not encryption.

Answer

Bucket policy

Answer

Versioning

Answer

Lifecycle configuration

Question 10

Which THREE steps are required to set up cross-account access to an Amazon S3 bucket using an IAM role in the bucket owner's account? (Choose THREE.)

Accepted Answer

Create an IAM role in the bucket owner's account with a trust policy that allows the other account to assume it.. Option A is correct because cross-account role assumption requires an IAM role in the bucket owner's account whose trust policy (AssumeRolePolicyDocument) explicitly lists the other AWS account (or its principals) as a trusted Principal, allowing sts:AssumeRole to succeed. Option B is correct because the role itself must have an identity-based IAM policy granting the needed S3 actions (e.g., s3:GetObject, s3:PutObject) on the target bucket/objects, since the role's permissions determine what the assumed session can do. Option E is correct because the IAM user (or role) in the trusting/other account needs an identity-based policy allowing sts:AssumeRole on the role's ARN; without this, the caller cannot obtain temporary credentials even if the trust policy permits it. Option C is not required because a VPC endpoint only affects private network routing to S3 and is unrelated to cross-account authorization. Option D is not required because, when access is granted through an IAM role in the bucket owner's account, the role's identity-based policy (plus trust policy) is sufficient; a bucket policy is not mandatory unless the role's account differs from the bucket owner or the bucket policy explicitly delegates access.

Answer

Set up a VPC endpoint for Amazon S3.

Answer

Add an S3 bucket policy that grants the other account access to the bucket.

Question 11

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function asynchronously. What does the response indicate?

Accepted Answer

The function invocation was accepted but the function failed to execute successfully.. When a Lambda function is invoked asynchronously (using the 'Event' invocation type), AWS Lambda queues the event and immediately returns a 202 Accepted status code. This indicates that the invocation request was successfully accepted and queued for execution. It does not mean the function failed to execute, nor does it guarantee successful execution, as the actual execution happens asynchronously and its status must be tracked via CloudWatch Logs, Destinations, or DLQs.

Answer

The function executed successfully and returned output.

Answer

The invocation was denied due to insufficient permissions.

Answer

The function was invoked synchronously and returned an error.

Question 12

Refer to the exhibit. A developer deploys this CloudFormation stack. The Lambda function is triggered by SQS messages. However, the function fails to process messages. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role does not have permissions to poll from SQS.. The Lambda function's execution role must include permissions for the `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` actions to poll messages from an SQS queue. Without these permissions, the Lambda service cannot retrieve messages from the queue, causing the function to fail processing even if the event source mapping is correctly configured.

Answer

The SQS queue event source mapping is not configured correctly.

Answer

The batch size of 10 exceeds the maximum allowed batch size.

Answer

The Lambda function code has a syntax error.

Question 13

A developer is debugging a Lambda function that is triggered by an S3 event. The function is supposed to process images and store metadata in DynamoDB. However, the function times out after 3 seconds for large images. The function's timeout is currently set to 5 seconds. What should the developer do to resolve the issue without increasing the timeout?

Accepted Answer

Increase the Lambda function's memory allocation to improve performance.. Increasing the Lambda function's memory allocation also increases CPU and network performance, which can reduce execution time for CPU-bound or memory-bound tasks like image processing. This allows the function to complete within the current timeout without increasing the timeout value. Option C, multipart upload or stream processing, is not directly applicable to processing images within a Lambda function; it applies to uploading large objects to S3, not to processing within Lambda. Option B increases timeout, which is explicitly prohibited. Option D introduces asynchronous processing via SQS, but that does not address the timeout issue within the function itself.

Answer

Increase the Lambda function's timeout to 15 minutes.

Answer

Use multipart upload or stream processing to handle the image in chunks.

Answer

Offload the processing to an Amazon SQS queue and process asynchronously.

Question 14

A company uses AWS Lambda to process incoming messages from an Amazon SQS queue. The Lambda function sometimes fails with a timeout error when the queue has a large backlog. What is the MOST efficient way to increase throughput without causing duplicate processing?

Accepted Answer

Decrease the batch size in the event source mapping.. When an SQS queue has a large backlog, Lambda retrieves the maximum number of messages allowed by the configured batch size. If processing this full batch takes longer than the Lambda function's timeout, the function times out and fails. When a Lambda function times out, the entire batch of messages is returned to the queue, leading to duplicate processing of messages that may have already been processed during that run. Decreasing the batch size (Option C) ensures that the function receives fewer messages per invocation, allowing it to successfully complete within its timeout limit, which stops the cycle of timeouts and retries, thereby increasing actual throughput.

Answer

Increase the batch size in the event source mapping.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Increase the reserved concurrency of the Lambda function.

Question 15

A developer is designing a serverless application that processes large files uploaded to Amazon S3. Each file can be up to 5 GB. The processing involves extracting metadata and generating thumbnails. The developer wants to minimize processing time and cost. Which approach should the developer take?

Accepted Answer

Use an S3 event notification to invoke a Lambda function that downloads the file, processes it, and uploads results.. S3 event notifications can trigger a Lambda function immediately after an object is uploaded. The Lambda function can download the file from S3, extract metadata and generate thumbnails, then store the results. This approach is serverless and cost-effective, as you pay only for compute time. While Lambda has execution time and memory limits, processing a 5 GB file for metadata and thumbnails can be optimized to fit within these limits, making it the most appropriate choice among the options.

Answer

Use S3 Object Lambda to process the object as it is being retrieved.

Answer

Use an S3 event notification to invoke a Lambda function that copies the object to an EC2 instance for processing.

Answer

Use AWS Fargate to run a container that polls S3 for new objects and processes them.