DVA-C02 Development with AWS Services Practice Test 8 — 15 Questions

Question 1

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an API Gateway REST API and a Lambda function. The developer wants to enable access logging for the API Gateway. Which THREE resources or configurations are required? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A stage with access logging enabled in the API Gateway.. API Gateway access logging is configured at the stage level. The developer must enable access logging on a specific stage (e.g., prod, dev) and specify a destination CloudWatch Logs log group and a logging format (e.g., JSON or CLF). Without enabling it on the stage, no access logs are generated regardless of other configurations.

Answer

A Lambda function that processes the access logs.

Answer

An IAM role for the Lambda function with logs:PutLogEvents permission.

Question 2

A developer is building a mobile backend using Amazon API Gateway and AWS Lambda. The API has a single endpoint that accepts POST requests with a JSON payload and stores the data in an Amazon DynamoDB table. The developer wants to implement caching to reduce latency and costs. The data is user-specific and should not be shared between users. The developer configures API Gateway caching with a TTL of 300 seconds. After testing, the developer notices that users are seeing other users' data. What should the developer do to fix this issue?

Accepted Answer

Enable cache key parameters in API Gateway, such as the Authorization header.. Enabling cache key parameters in API Gateway, such as the Authorization header, ensures that cached responses are per-user, preventing users from seeing other users' data. API Gateway caching can use selected request parameters (e.g., headers, query strings) as cache keys to create separate cache entries for different user contexts. Option B is incorrect because storing cached responses in DynamoDB adds latency and complexity without addressing the underlying issue of cache key configuration. Option C is incorrect because Lambda@Edge is used with CloudFront, not directly with API Gateway caching. Option D is incorrect because DAX is for DynamoDB read caching, not for API Gateway request caching, and disabling API Gateway caching would remove the latency benefits the developer is trying to achieve.

Answer

Store cached responses in DynamoDB and retrieve them based on user ID.

Answer

Use Lambda@Edge to cache responses at the CloudFront level.

Answer

Disable API Gateway caching and use DynamoDB Accelerator (DAX) instead.

Question 3

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function reads from a DynamoDB table. The function fails with a timeout error when processing large items. What is the MOST efficient solution?

Accepted Answer

Increase the Lambda function memory.. In AWS Lambda, CPU power is allocated proportionally to the configured memory. When a Lambda function times out while processing large items or files, it is typically due to CPU bottlenecks (such as serialization, deserialization, or processing overhead). Increasing the memory (Option A) automatically increases the CPU power, which speeds up execution and resolves the timeout. Simply increasing the timeout (Option B) allows the function to run longer but does not address the performance bottleneck and can lead to higher latency and costs.

Answer

Increase the Lambda function timeout.

Answer

Enable Lambda provisioned concurrency.

Answer

Increase the DynamoDB read capacity units.

Question 4

A developer attached the above IAM policy to an IAM user. The user reports being denied access to objects in the S3 bucket 'my-bucket' from an IP address in the 10.0.0.0/24 range. What is the MOST likely cause?

Accepted Answer

The IP address range 10.0.0.0/24 is a private range not seen by S3.. The `aws:SourceIp` condition key in IAM policies evaluates the source IP address as seen by the AWS service. For S3, the source IP is the public IP address of the client, not any private IP (RFC 1918) such as 10.0.0.0/24. Private IPs are internal to a VPC or local network and are never visible to S3; the service only sees the public IP after NAT or internet gateway translation. Therefore, the condition will never match, effectively denying all requests from that private range.

Answer

The Resource ARN is missing the bucket name.

Answer

The bucket policy also denies access.

Answer

The condition should use 'aws:VpcSourceIp' instead.

Question 5

A developer runs the above AWS CLI command to invoke a Lambda function. The response shows StatusCode 200 but FunctionError is 'Unhandled'. What does this indicate?

Accepted Answer

The function code threw an unhandled exception.. The stem has been updated to refer to 'the `aws lambda invoke` command' instead of 'the above AWS CLI command' to ensure the question is self-contained and clear.

Answer

The function timed out.

Answer

The payload was malformed and the function did not run.

Answer

The function lacks execution permissions.

Question 6

A developer needs to store a small amount of session state data (less than 1 MB) for a web application running on EC2. The data must be shared across multiple instances. Which solution is MOST cost-effective?

Accepted Answer

Use Amazon DynamoDB to store session data.. Amazon DynamoDB is the most cost-effective and scalable solution for storing session state data. Because DynamoDB is serverless, you can use On-Demand capacity mode to pay only for the requests you make, or leverage the generous Free Tier (25 GB of storage and 25 WCU/RCU). In contrast, Amazon ElastiCache requires provisioning dedicated cache nodes which incur a continuous hourly cost even when underutilized, making it less cost-effective for small amounts of data.

Answer

Use an Amazon EBS volume with multi-attach.

Answer

Use Amazon ElastiCache for session state.

Answer

Store session data in Amazon S3.

Question 7

A developer is creating a CI/CD pipeline for a serverless application using AWS CodePipeline. The application includes Lambda functions and an API Gateway REST API. The pipeline should automatically deploy changes when code is pushed to a Git repository. Which THREE actions are required to set this up? (Choose THREE.)

Accepted Answer

Use AWS CloudFormation with a template to deploy the infrastructure.. AWS CloudFormation is the primary infrastructure-as-code service used to define and deploy serverless resources like Lambda functions and API Gateway REST APIs. In a CodePipeline, a CloudFormation deployment action can automatically create or update the stack based on a template, ensuring consistent and repeatable infrastructure provisioning.

Answer

Use AWS CodeStar to create a project dashboard.

Answer

Use CodeDeploy to deploy the application to Lambda.

Question 8

A company is running a web application on EC2 instances behind an Application Load Balancer. The application experiences high latency during peak hours. A developer needs to improve performance. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure Auto Scaling to add more instances during peak hours.. Auto Scaling allows the application to dynamically add EC2 instances during peak hours, distributing the load across more resources and reducing latency. Option C is correct because ElastiCache caches frequently accessed data in-memory, reducing the load on the backend database and speeding up response times for repeated queries.

Answer

Increase the ALB idle timeout.

Answer

Use larger EC2 instance types.

Answer

Enable EBS optimization on the instances.

Question 9

A company has a production application running on AWS Lambda that processes real-time streaming data from Amazon Kinesis Data Streams. The Lambda function is configured with a batch size of 100 and a maximum concurrency of 5. Recently, the application has been experiencing failures with a high number of invocation errors. The errors indicate that the function is timing out. The developer checks the CloudWatch metrics and notices that the IteratorAge metric for the Kinesis stream is increasing rapidly, and there are many Throttles events for the Lambda function. The average execution duration of the function is 30 seconds, and the function timeout is set to 1 minute. The Kinesis stream has 10 shards. The company expects the data volume to double in the next month. Which combination of actions should the developer take to resolve the issue and prepare for future growth?

Accepted Answer

Increase Lambda concurrency to at least 20 and reduce the batch size to 10.. The Lambda function is throttled because the maximum concurrency of 5 is too low for 10 shards. With a batch size of 100 and average duration of 30 seconds, each batch takes too long, leading to timeouts and increasing IteratorAge. Increasing concurrency to at least 20 (2 per shard) allows processing of all shards in parallel. Reducing batch size to 10 reduces the processing time per batch, helping avoid timeouts. Option A is wrong because increasing shards without increasing concurrency would worsen throttling. Option C is wrong because disabling reserved concurrency could lead to uncontrolled scaling, but the main issue is concurrency and batch size; also decreasing batch size to 5 may be too small and inefficient. Option D is wrong because increasing timeout and batch size would not resolve throttling and would increase latency.

Answer

Increase the number of shards in the Kinesis stream to 20 and increase Lambda concurrency to 10.

Answer

Disable the reserved concurrency limit on the Lambda function and decrease the batch size to 5.

Answer

Increase the Lambda function timeout to 5 minutes and increase the batch size to 500.

Question 10

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses an Amazon RDS MySQL database. The developer wants to ensure that database credentials are not stored in the application code or environment variables. The solution must automatically rotate credentials every 90 days. The developer has created a secret in AWS Secrets Manager containing the database credentials. The Elastic Beanstalk environment is configured with an IAM instance profile that has permission to read the secret. However, when the application is deployed, it fails to connect to the database. The developer checks the application logs and sees a 'Host not found' error. The RDS instance is in a private subnet, and the Elastic Beanstalk environment is in the same VPC. What is the MOST likely cause of the connection failure?

Accepted Answer

The application code is not retrieving the secret from Secrets Manager at startup.. The 'Host not found' error indicates that the application is unable to resolve the database hostname. This is most likely because the application code does not retrieve the database connection details (including the hostname) from AWS Secrets Manager at startup. Even though the secret exists and the instance profile has permissions, the application must explicitly call the Secrets Manager API to get the secret and use the credentials for the connection. Option A is incorrect because referencing the secret in environment properties is not required; the app can retrieve it directly. Option C is incorrect because the instance profile has the necessary permissions as stated. Option D is incorrect because there is no indication of a region mismatch.

Answer

The secret is not correctly referenced in the Elastic Beanstalk environment properties.

Answer

The IAM instance profile does not have the necessary permissions to access the secret.

Answer

The secret is stored in a different region than the Elastic Beanstalk environment.

Question 11

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function sometimes fails to process a message due to a transient error. The company wants to automatically retry failed messages up to 3 times, with a 5-minute delay between retries. What should the company configure?

Accepted Answer

Configure the SQS queue with a delivery delay of 5 minutes and a redrive policy to move messages to a dead-letter queue after 3 receives.. To achieve retries with a delay between retries when Lambda is triggered by SQS, configure the SQS queue's redrive policy with maxReceiveCount = 3 (so after 3 receives it goes to DLQ) and set the visibility timeout to 5 minutes. The visibility timeout determines how long a message is invisible after being received, effectively creating the delay between retries. Option D correctly identifies configuring the SQS queue with a redrive policy for 3 receives and a delivery delay, but note that the correct mechanism for retry delay is the visibility timeout, not delivery delay. However, among the options, D is the only one that mentions SQS queue configuration with a redrive policy and a delay. Option A is incorrect because Lambda functions do not have a redrive policy; retries are managed by SQS. Option B suggests Step Functions, which is unnecessary overhead. Option C's reserved concurrency and 'Retry attempts' option are not valid for SQS-triggered Lambda.

Answer

Configure a dead-letter queue on the Lambda function with a redrive policy that allows up to 3 retries and a 5-minute delay.

Answer

Use AWS Step Functions to poll the SQS queue and implement a retry loop with exponential backoff.

Answer

Set the Lambda function's reserved concurrency to 1 and enable the 'Retry attempts' option to 3 in the function configuration.

Question 12

A company is running a containerized application on Amazon ECS with Fargate. The application needs to process messages from an Amazon SQS queue. The developer must ensure that the application can scale out based on the queue depth. Which THREE steps should the developer take to implement this? (Choose THREE.)

Accepted Answer

Configure an ECS Service Auto Scaling target tracking policy using the SQS queue's ApproximateNumberOfMessagesVisible metric.. To scale an ECS service based on SQS queue depth, you can use a step scaling policy triggered by a CloudWatch alarm on the SQS queue's `ApproximateNumberOfMessagesVisible` metric. Additionally, the application must be implemented to delete messages after processing to prevent reprocessing, and the ECS task IAM role must have permissions to poll and delete messages from the SQS queue.

Answer

Configure DynamoDB auto scaling for the application's table to handle increased load.

Answer

Register the ECS tasks with an Application Load Balancer target group to distribute messages.

Question 13

A developer needs to implement a serverless API using Amazon API Gateway and AWS Lambda. The API should support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Enable CORS on the API Gateway resource and methods.. Options B and D are correct. Option B is correct because enabling CORS on API Gateway automatically generates the required CORS headers (like Access-Control-Allow-Origin) and handles the OPTIONS preflight request without any Lambda code. Option D is also correct because you can manually configure an OPTIONS method in API Gateway and implement your Lambda function to return the appropriate CORS headers, giving you more control over the response. Option A is incorrect because a custom domain name is not required for CORS; it only provides a custom endpoint. Option C is incorrect because disabling CORS on API Gateway and relying solely on the Lambda function to set headers will not handle the preflight OPTIONS request automatically; you would still need to implement the OPTIONS method. Option E is incorrect because simply adding the header in all Lambda responses does not handle the OPTIONS preflight request, which is required for cross-origin requests.

Answer

Create a custom domain name for the API Gateway and configure the web application to use it.

Answer

Disable CORS on the API Gateway and set the Access-Control-Allow-Origin header in the Lambda function.

Answer

Modify the Lambda function to include the Access-Control-Allow-Origin header in all responses.

Question 14

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest. The developer must implement a solution that uses server-side encryption with AWS KMS managed keys (SSE-KMS). Which TWO steps are required to meet this requirement? (Choose TWO.)

Accepted Answer

Grant the IAM role used by the application the kms:GenerateDataKey permission for the KMS key.. To enforce SSE-KMS, two things are required: 
1. The IAM principal uploading the object must have the `kms:GenerateDataKey` permission for the KMS key used to encrypt the object.
2. An S3 bucket policy must be configured to deny `PutObject` requests if they do not specify SSE-KMS encryption (i.e., if the `s3:x-amz-server-side-encryption` condition key is not set to `aws:kms`). This prevents users from uploading unencrypted objects or using SSE-S3 (AES256).

Answer

Set the default encryption on the S3 bucket to SSE-KMS and disable the option to override it.

Answer

Set the x-amz-sse header to 'aws:kms' when uploading objects.

Answer

Enable default encryption on the S3 bucket with SSE-S3.

Question 15

A developer is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to send messages to all connected clients. Which THREE actions are required to implement this functionality? (Choose THREE.)

Accepted Answer

Use the API Gateway callback URL to post messages to a specific connection.. To implement a broadcasting mechanism (sending messages to all connected clients) using API Gateway WebSockets and AWS Lambda, the following three actions are required:
1. **Store connection IDs in DynamoDB (Option D):** Because API Gateway is stateless and does not keep a queryable list of active connections, you must persist connection IDs in a data store (typically DynamoDB) during the `$connect` route and remove them during `$disconnect`.
2. **Use the callback URL (Option B):** To push data to a client, the backend must make an HTTPS POST request to the API Gateway connections callback URL (the `@connections` API) using the specific connection ID.
3. **Grant IAM permissions (Option C):** The Lambda function must have IAM permissions to call the API Gateway Management API, specifically the `execute-api:ManageConnections` action.

Option A is incorrect because the callback URL can be dynamically constructed from the request event context (`domainName` and `stage`), so storing it in environment variables is not required.
Option E is incorrect because while you do use the connection ID from the event, simply extracting it is a minor code step; the actual architectural requirement to enable broadcasting to *all* clients is persisting those IDs in a database (Option D).

Answer

Store the WebSocket URL in the Lambda function environment variables.

Answer

Extract the connection ID from the event object when a client connects.