DVA-C02 Development with AWS Services Practice Test 9 — 15 Questions

Question 1

A developer is using AWS Lambda with an Amazon DynamoDB trigger. The Lambda function processes items from a DynamoDB Stream. The developer needs to ensure that the function processes each change exactly once and in order. Which TWO configurations should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a reserved concurrency for the Lambda function to limit concurrent executions.. Option C is correct because setting reserved concurrency on the Lambda function limits how many concurrent instances can process the stream, which is essential for preserving ordering since DynamoDB Streams shards are processed sequentially and parallel invocations could otherwise interleave records out of order. Option D is correct because setting the batch size to 1 in the event source mapping ensures the function receives a single stream record per invocation, so a failure only affects that one record and it can be retried without reprocessing or skipping others, supporting exactly-once and in-order processing. Options A, B, and E do not belong: DynamoDB Streams is the required trigger for this scenario and a FIFO queue is not a DynamoDB Streams event source; increasing concurrency would allow more parallel processing and risk out-of-order handling; and enabling a batch window only aggregates records over time, which does not guarantee exactly-once or ordered processing.

Answer

Use a FIFO queue as an event source instead of DynamoDB Streams.

Answer

Increase the Lambda function's concurrency limit.

Answer

Enable the batch window in the event source mapping.

Question 2

Refer to the exhibit. An IAM policy is attached to a Lambda function's execution role. The Lambda function is triggered by an S3 event and needs to invoke another Lambda function and decrypt an S3 object encrypted with a customer-managed KMS key. However, the invocation fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The policy is missing kms:GenerateDataKey and kms:Decrypt might not be sufficient for all decryption scenarios.. First, there is no exhibit provided in the prompt. Second, the explanation states that `kms:GenerateDataKey` is required to decrypt an S3 object; this is technically incorrect. To decrypt an S3 object encrypted with SSE-KMS, the IAM identity only requires `kms:Decrypt` (along with `s3:GetObject`). `kms:GenerateDataKey` is only required when uploading (encrypting) an object. Third, if the 'invocation fails with an access denied error' when trying to invoke another Lambda function, the root cause would be a missing `lambda:InvokeFunction` permission, not a KMS permission.

Answer

The policy does not allow s3:GetObject on the S3 bucket.

Answer

The policy resource for Lambda is incorrect.

Answer

The policy does not allow kms:Decrypt for the key.

Question 3

Refer to the exhibit. A developer creates a CloudFormation stack with this template. The developer wants to ensure that all objects uploaded to the bucket are encrypted at rest using SSE-KMS. However, the current policy allows anyone to put objects without encryption. What additional change is needed to enforce SSE-KMS?

Accepted Answer

Add a bucket policy that denies PutObject if encryption is not set.. First, the exhibit (CloudFormation template/policy) is completely missing from the prompt, making the question impossible to evaluate. Second, setting the bucket's default encryption to SSE-KMS (Option A) does not strictly 'enforce' SSE-KMS because clients can still explicitly send headers for SSE-S3 (AES256), which overrides the bucket's default setting. To truly enforce SSE-KMS and prevent unencrypted or SSE-S3 uploads, an explicit bucket policy denying `s3:PutObject` when `s3:x-amz-server-side-encryption` is not `aws:kms` (Option B) is required.

Answer

Set the bucket's default encryption configuration to SSE-KMS.

Answer

Modify the condition to use s3:x-amz-server-side-encryption-aws-kms-key-id.

Answer

Remove the condition to allow all PutObject requests.

Question 4

A company runs a production web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic across multiple EC2 instances in an Auto Scaling group. The application uses an Amazon Aurora MySQL database. The operations team reports that the application is experiencing intermittent latency spikes, especially during peak hours. Investigation reveals that the database CPU utilization is consistently above 80% and there are many slow queries. The developer is asked to improve database performance without changing the application code. Which solution should the developer implement?

Accepted Answer

Upgrade the Aurora instance to a larger instance type.. Upgrading the Aurora instance to a larger instance type (vertical scaling) increases the CPU and memory resources available to the database. This directly addresses high CPU utilization and improves the performance of slow queries (e.g., by providing more processing power and larger buffer pools for caching data in memory) without requiring any changes to the application code or connection endpoints. Option A (RDS Proxy) is incorrect because it is used to manage connection pooling (typically for highly transient connections like AWS Lambda) and does not resolve CPU bottlenecks caused by slow queries. Option B is incorrect because implementing Amazon ElastiCache requires modifying the application code to introduce caching logic. Option C is incorrect because scaling out the EC2 instances will increase the load and connection count on the database, worsening the CPU bottleneck.

Answer

Implement an Amazon RDS Proxy in front of the Aurora cluster to manage database connections efficiently.

Answer

Use Amazon ElastiCache to cache frequently accessed data.

Answer

Increase the desired capacity of the Auto Scaling group to add more EC2 instances.

Question 5

A company uses AWS Lambda to process user-uploaded images stored in an S3 bucket. Recently, the Lambda function started timing out, and CloudWatch Logs show 'Error: Unable to locate credentials' in the function logs. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have the necessary IAM policy to access the S3 bucket.. The correct answer is C: the Lambda execution role lacks the necessary IAM policy to access the S3 bucket. In AWS Lambda, credentials are provided automatically through the execution role via the environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN, which are populated by the Lambda service from temporary STS credentials; if the role's trust or permissions are misconfigured, the SDK cannot retrieve credentials and reports 'Unable to locate credentials'. Option A is incorrect because Lambda injects these variables automatically and users should not set them manually. Option B is incorrect because all supported Lambda runtimes can use the AWS SDK, and the error is credential-related, not runtime-related. Option D is incorrect because explicitly setting credentials in code is an anti-pattern and would not produce this specific error unless the code failed to obtain them.

Answer

The function's environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are missing.

Answer

The Lambda function is configured with a different runtime that does not support the AWS SDK.

Answer

The function's code is explicitly setting AWS credentials using the AWS SDK.

Question 6

A developer is building a REST API using API Gateway and AWS Lambda. The API must support long-running operations that can take up to 30 minutes. The current implementation uses synchronous Lambda invocation, causing API Gateway to timeout after 29 seconds. What solution should the developer implement?

Accepted Answer

Use an SQS queue to decouple the request and have the client poll for results.. API Gateway has a hard 29-second timeout for integration requests, which cannot be increased. Since the operations can take up to 10 minutes, a synchronous call will always fail due to the API Gateway timeout. By using an SQS queue to decouple the request, API Gateway can quickly accept the request, write it to SQS, and return a 202 Accepted response to the client. A Lambda function can then process the message from the SQS queue asynchronously (which is well within Lambda's 15-minute execution limit), while the client polls a status endpoint for the results.

Answer

Increase the Lambda function timeout to 30 minutes.

Answer

Use Lambda function URL directly and bypass API Gateway.

Answer

Change the API Gateway integration to HTTP_PROXY type.

Question 7

Which TWO actions should a developer take to securely store secrets (e.g., database passwords) used by a Lambda function?

Accepted Answer

Use AWS Secrets Manager to store and retrieve the secret at runtime.. Option A is correct because AWS Secrets Manager is purpose-built for storing and rotating secrets such as database passwords, and the Lambda function can retrieve the secret at runtime via the AWS SDK (GetSecretValue) using its execution role, so the plaintext secret is never persisted in code or configuration. Option C is correct because AWS Systems Manager Parameter Store supports SecureString parameters, which are encrypted with AWS KMS (e.g., the default alias/aws/ssm key or a customer managed key) and can be fetched at runtime by the Lambda execution role, providing secure storage without embedding credentials in the function. Option B is not appropriate because an S3 object is not a secrets-management service; even with SSE and IAM policies, the secret is stored as ordinary object data and lacks native rotation and fine-grained secret lifecycle controls. Option D is wrong because Lambda environment variables are stored in plaintext (visible in the console and GetFunctionConfiguration) and are not encrypted at rest by default, so they are unsuitable for secrets. Option E is wrong because hardcoding secrets in source code exposes them in version control, deployment packages, and logs, and makes rotation impractical.

Answer

Upload the secret to an S3 bucket and read it from the Lambda function.

Answer

Store the secret as an environment variable in the Lambda function.

Answer

Hardcode the secret in the Lambda function code.

Question 8

Which THREE steps are required to enable cross-account access to a DynamoDB table from a Lambda function in another AWS account?

Accepted Answer

Create a resource-based policy on the DynamoDB table that allows access from the Lambda execution role.. To enable cross-account access to a DynamoDB table using resource-based policies (introduced in late 2023), two steps are required: 
1. Attach a resource-based policy to the DynamoDB table in the destination account that grants access to the Lambda execution role in the source account.
2. Attach an identity-based policy to the Lambda execution role in the source account that allows access to the cross-account DynamoDB table.

Assuming a role is an alternative legacy method and is not used in conjunction with DynamoDB resource-based policies.

Answer

Configure the Lambda function to assume an IAM role in the DynamoDB account.

Answer

Add a trust policy to the Lambda execution role allowing the DynamoDB account to access it.

Answer

Add a bucket policy to the DynamoDB table to allow cross-account access.

Question 9

Which TWO AWS services can be used to trigger an AWS Lambda function asynchronously?

Accepted Answer

Amazon EventBridge. Options A and D are correct. Amazon EventBridge can asynchronously invoke Lambda in response to events from various AWS services. Amazon S3 can asynchronously invoke Lambda via bucket notifications for object create events. API Gateway (B) invokes Lambda synchronously by default. CloudWatch Events (C) is a legacy service replaced by EventBridge and is not considered a separate correct answer. Step Functions (E) invokes Lambda synchronously.

Answer

Amazon API Gateway (REST API)

Answer

Amazon CloudWatch Events (scheduled events)

Answer

AWS Step Functions (synchronous)

Question 10

Which THREE statements are true about AWS Lambda concurrency and scaling?

Accepted Answer

Provisioned concurrency can be used to reduce cold start latency.. Option A is correct because provisioned concurrency pre-initializes a specified number of execution environments for a function, so invocations are served by already-warm environments and cold start latency is effectively eliminated. Option B is correct because Lambda uses a per-region, per-account concurrency model in which each incoming request (or each shard/partition event source) can trigger a new execution environment, and the service automatically scales the number of concurrent executions up to the account's concurrency limit. Option C is correct because Lambda's burst concurrency quota allows an initial burst of 500 to 3000 concurrent executions per region (the exact value depends on the region), after which concurrency can continue to grow by 500 per minute until the account limit is reached. Option D is not marked correct because reserved concurrency sets aside a maximum number of concurrent executions for a function and also guarantees that capacity is not taken by other functions; it does not guarantee a minimum number of concurrent executions. Option E is not marked correct because the concurrency limit is an account-level, per-region quota (default 1,000) that can be increased via a Service Quotas increase request, not a fixed per-function limit that cannot be raised.

Answer

Reserved concurrency guarantees a minimum number of concurrent executions.

Answer

Lambda's concurrency limit is per function and cannot be increased.

Question 11

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and several Lambda functions. The developer wants to enable X-Ray tracing to debug performance issues. What is the MINIMUM set of actions required to enable X-Ray tracing for the entire application?

Accepted Answer

Add Tracing: Active to the Globals section of the SAM template and attach the AWSXRayDaemonWriteAccess managed policy to the Lambda execution role.. In AWS SAM, you can enable X-Ray tracing globally for all Lambda functions by adding 'Tracing: Active' under the Globals section of the SAM template. When this property is set, AWS SAM automatically attaches the 'AWSXrayWriteOnlyAccess' managed policy to the auto-generated Lambda execution roles. Therefore, manually attaching an X-Ray policy is redundant and not part of the minimum set of actions. Option A is incorrect because enabling tracing individually is not the minimum configuration. Option B is incorrect because enabling tracing on API Gateway alone does not enable active tracing on Lambda. Option C is incorrect because Lambda runs its own X-Ray daemon; you do not package it as a sidecar container.

Answer

Enable X-Ray tracing on each Lambda function individually and deploy the X-Ray daemon as a Lambda layer.

Answer

Enable X-Ray tracing only on the API Gateway stage and configure the Lambda functions to forward traces.

Answer

Deploy the X-Ray daemon as a sidecar container on each Lambda function.

Question 12

A company is using AWS CodePipeline to automate deployments of a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The deploy stage fails intermittently with the error 'Rate exceeded' when creating or updating stacks. What should the developer do to resolve this issue?

Accepted Answer

Request a service limit increase for CloudFormation API calls.. The 'Rate exceeded' error indicates that the AWS CloudFormation API throttling limits have been exceeded. This typically happens when multiple pipelines or processes are making concurrent calls to CloudFormation (such as CreateStack, UpdateStack, or DescribeStacks). Because the CloudFormation deployment action in CodePipeline is a managed action, developers cannot directly configure custom retry logic or exponential backoff parameters for it. To resolve this intermittent throttling issue, the developer should request a service quota (limit) increase for the CloudFormation API throttling limits from AWS Support.

Answer

Use the AWS CLI to deploy the CloudFormation stack instead of CodePipeline.

Answer

Increase the timeout for the CloudFormation deployment action in the pipeline.

Answer

Add a retry configuration with exponential backoff to the CloudFormation deployment action.

Question 13

A developer is creating a CI/CD pipeline using AWS CodeBuild and AWS CodeDeploy for a Java application that runs on EC2 instances. The build process must compile the code, run unit tests, and package the application into a WAR file. The deployment should use the blue/green deployment strategy. What is the correct sequence of actions?

Accepted Answer

Use CodeCommit to store the source code, CodeBuild to build, and CodePipeline to orchestrate the deployment.. CodeCommit stores source code, CodeBuild builds the application (compile, test, package into WAR), and CodePipeline orchestrates the entire pipeline including source, build, and deployment stages. CodeDeploy is used as the deployment provider within CodePipeline to perform blue/green deployments. Option A is correct because it describes the full CI/CD pipeline. Option D is incorrect because it omits the source stage and the orchestration layer provided by CodePipeline, which is essential for a complete CI/CD pipeline. Option B is incorrect because CodeDeploy is a deployment service, not a build service. Option C is incorrect because Elastic Beanstalk is a PaaS that abstracts the CI/CD process, not the direct use of CodeBuild and CodeDeploy.

Answer

Use CodeDeploy to build the application and then use CodePipeline to deploy it.

Answer

Use Elastic Beanstalk to build and deploy the application.

Answer

Use CodeBuild to compile and package the application, and then use CodeDeploy to perform the blue/green deployment.

Question 14

A developer is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage that uses an Amazon S3 bucket, a build stage that uses AWS CodeBuild, and a deploy stage that uses AWS CodeDeploy. The developer wants to ensure that the pipeline automatically triggers when a new file is uploaded to the S3 source bucket. Which TWO steps should the developer take to configure this? (Choose two.)

Accepted Answer

Enable S3 event notifications on the bucket to publish events to Amazon CloudWatch Events.. Option E is correct because when an S3 bucket is used as the source in a CodePipeline source action, CodePipeline can detect changes to the bucket using S3 source change detection (which relies on CloudWatch Events/EventBridge), so enabling that setting in the source action is the native way to have the pipeline start on new object uploads. Option B is correct because enabling S3 event notifications to publish events to Amazon CloudWatch Events (EventBridge) delivers the S3 object-created events that CodePipeline's change detection consumes to trigger the pipeline. Option A is incorrect because CodePipeline does not use S3-to-webhook HTTP requests for S3 source triggering; webhooks are used for source providers like GitHub/Bitbucket, not S3. Option C is incorrect because CloudTrail logs S3 PutObject API activity for auditing, but it does not trigger CodePipeline executions. Option D is incorrect because although a Lambda function could be written to call StartPipelineExecution, that is a custom workaround, not the required configuration for S3 source change detection.

Answer

Create a webhook in CodePipeline and configure S3 to send HTTP requests to the webhook URL.

Answer

Configure AWS CloudTrail to log S3 PutObject events and trigger the pipeline.

Answer

Create an AWS Lambda function that is invoked on S3 object creation and starts the pipeline.

Question 15

A developer is deploying a new version of a microservice that runs on AWS Fargate. The service is part of an Amazon ECS cluster and has an associated Application Load Balancer (ALB). The developer wants to perform a rolling update without downtime and ensure that at least 50% of the service's desired count remains available during the deployment. The current desired count is 4. The developer updates the task definition and triggers a new service deployment using the AWS CLI. After the update, the developer notices that the service briefly goes to 0 running tasks during the deployment, causing downtime. The ECS service deployment configuration has: minimumHealthyPercent=50 and maximumPercent=200. What is the most likely cause of this downtime?

Accepted Answer

The service is using the CODE_DEPLOY deployment controller instead of the default ECS rolling update controller.. The CODE_DEPLOY deployment controller does not use the ECS service's minimumHealthyPercent and maximumPercent parameters; instead, it relies on CodeDeploy deployment configurations (e.g., ECSLinear, ECSAllAtOnce, ECSBlueGreen) and lifecycle hooks. When the service uses CODE_DEPLOY, the ECS rolling update parameters are ignored, so the service can be scaled down to 0 tasks during the deployment if the CodeDeploy configuration allows it (e.g., ECSAllAtOnce). This explains why the service briefly goes to 0 running tasks despite minimumHealthyPercent=50.

Answer

The ALB health check is misconfigured, causing healthy tasks to be marked as unhealthy and replaced.

Answer

The minimumHealthyPercent value of 50% is too low, allowing the service to scale down to 0 tasks.

Answer

The ALB deregistration delay is set to 0, causing tasks to be removed immediately.