DVA-C02 Development with AWS Services Practice Test 7 — 15 Questions

Question 1

A developer needs to store session state for a web application running on multiple EC2 instances behind an Application Load Balancer. Which AWS service should the developer use for a fully managed, highly available session store?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache (specifically Redis) is the correct choice because it provides a fully managed, highly available, and low-latency in-memory data store ideal for session state management. While DynamoDB is also widely used for session state due to its serverless nature, ElastiCache is the premier choice when an 'in-memory' store is explicitly required for sub-millisecond performance.

Answer

Amazon RDS

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 2

Which THREE actions should a developer take to secure an AWS Lambda function that processes sensitive data? (Choose 3.)

Accepted Answer

Attach an IAM role with least privilege permissions.. Option B is correct because attaching an IAM execution role scoped to least privilege ensures the Lambda function can only call the exact AWS APIs and resources it needs, limiting blast radius if the code is compromised. Option C is correct because Lambda environment variables can hold sensitive configuration, and enabling KMS encryption (with a customer managed key) protects those values at rest and in transit to the execution environment. Option D is correct because placing the Lambda function inside a VPC lets it reach private resources such as RDS or ElastiCache over private subnets and security groups without exposing traffic to the public internet. Option A is not a security action by itself; storing configuration in environment variables is a convenience feature and only becomes secure when combined with KMS encryption. Option E is not a securing action for the function's data; CloudTrail provides API activity auditing and logging, which supports detection and compliance but does not protect the sensitive data the function processes.

Answer

Store configuration values in Lambda environment variables.

Answer

Enable AWS CloudTrail for the Lambda function.

Question 3

An IAM policy is attached to a user. What is the effect when the user tries to download an object from the 'confidential' folder in 'my-bucket' from an IP address within the 192.0.2.0/24 range?

Accepted Answer

The request is allowed.. The IAM policy includes both an Allow statement and a Deny statement. The Allow statement grants `s3:GetObject` for the `confidential` folder in `my-bucket` when the request originates from the IP range 192.0.2.0/24. The Deny statement denies the same action for requests from outside that range (using the `NotIpAddress` condition). Since the user's IP is within the 192.0.2.0/24 range, the Deny condition is not met (so the Deny does not apply), and the Allow condition is satisfied. Thus, the request is allowed, making Option C correct.

Answer

The request is denied.

Answer

The request results in an error due to conflicting statements.

Answer

The request is denied because the Deny statement overrides the Allow.

Question 4

A developer invoked a Lambda function using the AWS CLI. The response includes 'FunctionError': 'Handled'. What does this indicate?

Accepted Answer

The function threw an exception that was caught by the code.. When a Lambda function returns 'FunctionError': 'Handled', it indicates that the function execution failed because of an error thrown by the function code which was caught and handled by the Lambda runtime (for example, an uncaught exception in the function code). If the user's code had caught the exception and handled it without rethrowing or returning an error, the execution would have succeeded with no 'FunctionError'. 'Unhandled' is used when the runtime itself crashes, the function times out, or runs out of memory.

Answer

The function timed out.

Answer

The function executed successfully without any errors.

Answer

The function experienced an unhandled runtime error.

Question 5

A developer deployed this CloudFormation template. What happens to a message after it has been received from 'MyQueue' 3 times but not deleted?

Accepted Answer

The message is moved to the dead-letter queue.. The question stem mentions 'this CloudFormation template' but the actual YAML/JSON template is missing. The template must be included in the stem so that the user can see the RedrivePolicy and maxReceiveCount configuration of 3.

Answer

The message remains in the queue and is retried indefinitely.

Answer

The message is deleted from the queue.

Answer

The message is deleted after the visibility timeout expires.

Question 6

A company runs a microservices application on Amazon ECS with Fargate. Each service has its own task definition and uses service discovery via AWS Cloud Map. Recently, one service is failing to connect to another service using the service discovery endpoint. The developer verified that both services are running and the security groups allow traffic. What is the most likely cause of the connectivity issue?

Accepted Answer

The service discovery namespace is of type private but the DNS records are not being created.. For Amazon ECS service discovery using AWS Cloud Map with a private DNS namespace, AWS creates a Route 53 private hosted zone associated with your VPC. For resources within the VPC to resolve these private DNS queries, both 'enableDnsSupport' and 'enableDnsHostnames' must be set to 'true' in the VPC configuration. If either is disabled, DNS resolution for the service discovery endpoints will fail, even if the tasks are healthy and security groups are correctly configured.

Answer

The task definitions are not using the awsvpc network mode.

Answer

The service discovery namespace is of type public and the services are in a private subnet.

Answer

The VPC does not have an internet gateway attached.

Question 7

A developer is using API Gateway to expose a Lambda function as a REST API. The API must be accessible from a web application hosted on a different domain. The developer configured CORS but the browser still shows CORS errors. What should the developer do to resolve the issue?

Accepted Answer

Set the Access-Control-Allow-Origin header in the Lambda function response.. When using API Gateway with a Lambda proxy integration, enabling CORS via the API Gateway console only configures the OPTIONS preflight method. For the actual API request (such as GET or POST) to succeed without CORS violations in the browser, the backend Lambda function must explicitly return the 'Access-Control-Allow-Origin' header in its JSON response payload.

Answer

Enable CORS in API Gateway and ensure the OPTIONS method returns the required headers.

Answer

Configure the Lambda function to return HTTP 200 for preflight OPTIONS requests.

Answer

Add the web application's domain to an API Gateway usage plan.

Question 8

A developer is using AWS CodePipeline to automate CI/CD. The pipeline has a Source stage (CodeCommit), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The Build stage runs tests and packages the application. The developer notices that the Deploy stage is triggered even when the Build stage fails. How can the developer prevent deployment on build failure?

Accepted Answer

Set a transition between Build and Deploy stages that only allows successful builds.. In AWS CodePipeline, the default behavior is to stop the pipeline execution immediately if any action in a stage fails. If a Deploy stage is triggered despite test failures in the Build stage, it indicates that the CodeBuild build succeeded because the test command did not return a non-zero exit code. To prevent deployment on test failure, the developer must ensure that the test command in the buildspec.yml returns a non-zero exit code upon failure, which will cause the CodeBuild action (and thus the Build stage) to fail, stopping the pipeline.

Proposed Options:
- A: Ensure the test command in the buildspec.yml file returns a non-zero exit code on failure, which will fail the CodeBuild action and stop the pipeline. [CORRECT]
- B: Disable the transition between the Build and Deploy stages in CodePipeline. [WRONG]
- C: Add a manual approval action before the Deploy stage. [WRONG]
- D: Configure the Build stage with 'On failure: Abort' in the pipeline settings. [WRONG]

Answer

Add a manual approval action before Deploy stage.

Answer

Add a CloudWatch Events rule to trigger a Lambda function that stops the pipeline on build failure.

Answer

Configure the Build stage with 'On failure: Abort' in the pipeline settings.

Question 9

A company is using AWS CloudFormation to manage infrastructure. A developer needs to create a stack that will launch an EC2 instance and associate an Elastic IP address. The Elastic IP must be released when the stack is deleted. Which TWO resources should the developer include in the CloudFormation template? (Choose TWO.)

Accepted Answer

AWS::EC2::EIP. The developer must include AWS::EC2::EIP (option B) to allocate the Elastic IP address as a CloudFormation-managed resource; because CloudFormation owns the resource, it will automatically release the EIP when the stack is deleted, satisfying the requirement. The developer must also include AWS::EC2::EIPAssociation (option E) to bind that Elastic IP to the EC2 instance (or its network interface), since allocation and association are separate operations in CloudFormation. Option A (AWS::EC2::Instance) is needed to launch the instance, but the question asks specifically which resources are required to allocate and attach the EIP with automatic release, and the instance resource alone does not accomplish the EIP requirement. Option C (AWS::EC2::NetworkInterface) is not required because an EIP can be associated directly with an instance via EIPAssociation without declaring a separate network interface. Option D (AWS::EC2::Address) is not a valid CloudFormation resource type; the correct type for an Elastic IP is AWS::EC2::EIP.

Answer

AWS::EC2::Instance

Answer

AWS::EC2::NetworkInterface

Answer

AWS::EC2::Address

Question 10

A developer creates an S3 bucket. After creation, the developer tries to access https://my-app-data-123.s3.amazonaws.com/index.html but gets a 403 Forbidden error. The S3 bucket has public access blocked at the account level. What should the developer do to allow public read access?

Accepted Answer

Disable the block public access settings at the account level.. The stem has been cleaned up to remove references to an exhibit and CloudFormation template that are not provided, making the question self-contained and clear.

Answer

Enable static website hosting on the bucket.

Answer

Modify the bucket policy to include the AWS account ID as Principal.

Answer

Add a bucket policy that grants s3:ListBucket.

Question 11

A developer is building a serverless application using API Gateway and Lambda. The API Gateway REST API endpoint needs to be accessible only from a specific VPC. Which configuration should be used?

Accepted Answer

Configure a resource policy with a condition using aws:SourceVpc.. For an API Gateway private REST API, access must be explicitly allowed using an API Gateway resource policy. To restrict access to a specific VPC, you configure a resource policy with a condition block that allows access only when `aws:SourceVpc` matches the target VPC ID. Private APIs are accessed via interface VPC endpoints (execute-api), and the resource policy ensures that only traffic originating from the specified VPC is permitted.

Answer

Attach a security group to the API Gateway.

Answer

Create a VPC endpoint for API Gateway and associate it with the API.

Answer

Enable private DNS on the API Gateway API.

Question 12

An application running on Amazon ECS Fargate uses a DynamoDB table with on-demand capacity. The table has a partition key of 'userId' and a sort key of 'timestamp'. During peak hours, some requests experience throttling errors. The application performs updates to existing items using 'UpdateItem' with ConditionExpression to ensure the 'status' attribute is 'active'. Which design change will BEST reduce throttling?

Accepted Answer

Implement DynamoDB Accelerator (DAX) to cache frequent items.. DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache for Amazon DynamoDB. It is designed to handle read-heavy or hot-key workloads by caching read results (such as GetItem or Query). This prevents repeated read requests for the same items from reaching the DynamoDB table, thereby eliminating read throttling and reducing latency.

Answer

Use 'TransactWriteItems' instead of 'UpdateItem' for atomic updates.

Answer

Change the table to provisioned capacity and increase read capacity units.

Answer

Create a global secondary index with the same partition key and a different sort key.

Question 13

A company is using Amazon SQS to decouple microservices. The producer sends messages, and the consumer processes them. The consumer occasionally fails to process a message due to transient errors. What is the BEST way to ensure such messages are retried automatically?

Accepted Answer

Use a FIFO queue with content-based deduplication.. When a consumer retrieves a message from an SQS queue, the message remains in the queue but is hidden for the duration of the visibility timeout. If processing fails due to a transient error, the consumer should not delete the message. Once the visibility timeout expires, the message automatically becomes visible again in the queue for reprocessing. If the message was deleted, it would be lost; if it is not deleted, SQS handles the retry automatically.

Answer

Use a delay queue to postpone message processing.

Answer

Configure a dead-letter queue with a redrive policy on the source queue.

Answer

Increase the visibility timeout to give the consumer more time.

Question 14

A company is building a serverless application using AWS Lambda functions that write results to an Amazon DynamoDB table. The Lambda functions are invoked by an Amazon API Gateway REST API. During testing, some requests fail with a 503 status code. The Lambda function code is correct. What is the MOST likely cause of the 503 errors?

Accepted Answer

The Lambda function execution time exceeds the configured timeout.. When an AWS Lambda function is throttled (for example, due to reaching its concurrent execution limit), the Lambda service returns a 429 Too Many Requests error to API Gateway. API Gateway then maps this to a 503 Service Unavailable error to the client. If the Lambda function had timed out instead, API Gateway would return a 504 Gateway Timeout error.

Answer

The DynamoDB table has insufficient write capacity.

Answer

The Lambda function's IAM role does not have permission to write to DynamoDB.

Answer

The API Gateway stage has throttling limits configured.

Question 15

A developer is troubleshooting an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function processes new objects but sometimes fails because the object is not fully written before Lambda reads it. Which TWO actions can the developer take to fix this?

Accepted Answer

Implement a retry mechanism in the Lambda function to check object existence before processing.. Option A is correct because adding a retry mechanism that verifies the object exists and is fully written before processing handles the race condition where Lambda is invoked before the S3 PUT completes; retries with backoff let the write finish. Option C is correct because configuring the S3 event notification to fire only for objects with a specific suffix (e.g., a completion marker or final extension) ensures Lambda is triggered only after the object is fully uploaded, avoiding partial reads. Option B is wrong because S3 Transfer Acceleration only speeds up uploads over long distances and does not guarantee the object is complete when Lambda is invoked. Option D is wrong because an SQS queue buffers events but does not ensure the object is fully written before Lambda reads it. Option E is wrong because increasing the Lambda timeout only gives more time to run, not more time for the object to finish writing, so it does not fix the race condition.

Answer

Use S3 Transfer Acceleration.

Answer

Use an Amazon SQS queue to buffer the S3 events.

Answer

Increase the Lambda function timeout.