DVA-C02 Development with AWS Services Practice Test 9 — 15 Questions

Question 1

An IAM policy is attached to an IAM user. The user attempts to upload an object to s3://my-bucket/confidential/report.pdf from an IP address 192.168.1.100. What will happen?

Accepted Answer

The upload fails because the Deny statement blocks the request.. IAM policy evaluation follows an explicit deny priority: any Deny statement overrides any Allow statement when the Deny's condition is met. In this scenario, the Deny statement includes a condition that blocks the request if the source IP is not within a specified range (e.g., 10.0.0.0/8). Since the source IP 192.168.1.100 does not belong to that allowed range, the Deny condition is satisfied, and the Deny takes effect, overriding the Allow statement that grants s3:PutObject on all objects. Therefore, the upload fails.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on all objects in the bucket.

Answer

The upload succeeds because the IP address 192.168.1.100 matches the condition.

Answer

The upload fails because the Deny statement does not have a condition.

Question 2

A company runs a microservices application on Amazon ECS with Fargate. The application consists of three services: frontend, orders, and payments. The frontend service is behind an Application Load Balancer (ALB). The orders service processes requests from frontend and sends messages to the payments service via an Amazon SQS queue. The payments service polls the queue. Recently, during peak hours, the orders service experiences high latency and the SQS queue depth increases significantly. The monitoring shows that the payments service is not keeping up. The company wants to scale the payments service based on the queue depth. The developer has configured an ECS Service Auto Scaling target tracking policy using the SQS queue's ApproximateNumberOfMessagesVisible metric. However, the payments service is not scaling up as expected. What is the most likely cause?

Accepted Answer

The payments service has reached the maximum number of tasks allowed by the service quota.. The most likely cause is that the payments service has reached the maximum capacity limit defined in its Auto Scaling configuration (scalable target). ECS Service Auto Scaling cannot scale beyond the MaxCapacity limit specified in the scalable target, even if the scaling policy's metric indicates that more tasks are needed.

Option A is incorrect because target tracking policies fully support customized metric specifications (custom metrics).

Option B is incorrect because SQS automatically publishes the ApproximateNumberOfMessagesVisible metric to CloudWatch.

Option D is incorrect because polling frequency does not affect the scaling policy's ability to adjust the task count.

Answer

The target tracking policy is not configured correctly because ECS Service Auto Scaling requires a custom metric, and the metric may not have been published yet.

Answer

The SQS queue is not sending the ApproximateNumberOfMessagesVisible metric to CloudWatch.

Answer

The payments service is not configured to poll the SQS queue frequently enough.

Question 3

A developer is building an application that processes user-uploaded images. The application uses Amazon S3 to store the images and AWS Lambda to generate thumbnails. When a user uploads an image to an S3 bucket, an S3 event notification triggers a Lambda function. The Lambda function processes the image and saves the thumbnail to another S3 bucket. The developer notices that sometimes the Lambda function is not triggered after an upload. The developer checks the Lambda function's CloudWatch logs and sees no invocation records for those uploads. The S3 bucket event notification configuration appears correct. What is the most likely cause of this issue?

Accepted Answer

The S3 bucket and the Lambda function are in different AWS regions.. The most likely cause is that the S3 bucket and the Lambda function are in different AWS regions (Option D). S3 event notifications for Lambda are only supported when both the bucket and the function are in the same region. If they are in different regions, the event notification will not trigger the Lambda function, and no invocation records appear in CloudWatch logs. Option A is incorrect because the destination bucket's policy affects thumbnail writes, not the trigger. Option B is incorrect because S3 event notifications are asynchronous invocations, but they are reliably delivered and not typically lost. Option C is incorrect because the Lambda function's execution role permissions affect reading from the source bucket, not the triggering mechanism.

Answer

The destination S3 bucket does not have the correct bucket policy to allow the Lambda function to write thumbnails.

Answer

The S3 event notification is configured as an asynchronous invocation, and the event is lost.

Answer

The Lambda function's execution role does not have permission to read from the S3 bucket.

Question 4

A company is using AWS CodePipeline to automate the deployment of a web application. The pipeline has three stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The application is deployed to an Auto Scaling group of EC2 instances. Recently, a deployment failed because the CodeDeploy agent on one of the instances was not running. The developer wants to ensure that the CodeDeploy agent is always running on all instances. What is the MOST efficient solution?

Accepted Answer

Modify the Auto Scaling group's launch configuration to include a user data script that installs and starts the CodeDeploy agent.. Modifying the Auto Scaling group's launch configuration to include a user data script that installs and starts the CodeDeploy agent ensures that the agent is running on every new instance as soon as it launches. This is a proactive and automated approach that prevents deployment failures due to a missing or stopped agent without requiring additional monitoring or remediation steps. Option A (CloudTrail + Lambda) is reactive and less efficient. Option B (CloudWatch alarm) can detect but not automatically restart the agent. Option D (Systems Manager Run Command) requires scheduling and may not cover all instances. Therefore, option C is the most efficient solution.

Answer

Use AWS CloudTrail to monitor the CodeDeploy agent status and trigger an AWS Lambda function to restart it.

Answer

Configure a CloudWatch alarm to detect when the CodeDeploy agent is not running and restart it automatically.

Answer

Use AWS Systems Manager Run Command to run a script that checks and restarts the CodeDeploy agent on a schedule.

Question 5

A developer is creating an AWS Lambda function that processes files uploaded to an S3 bucket. The developer wants to invoke the Lambda function automatically when a new file is uploaded. Which approach should the developer use?

Accepted Answer

Configure S3 event notifications to invoke the Lambda function directly.. S3 can directly invoke a Lambda function via S3 event notifications. When a new object is created in the bucket, S3 publishes a notification with the event type `s3:ObjectCreated:*` and the Lambda function is triggered asynchronously. This is the simplest and most direct integration for this use case, requiring no intermediate services.

Answer

Use Amazon API Gateway to expose an endpoint and have S3 call it.

Answer

Configure S3 to send events to an SQS queue, and configure Lambda to poll the queue.

Answer

Use Amazon CloudWatch Events to trigger Lambda on S3 PUT events.

Question 6

A developer is working on a serverless application that uses Amazon DynamoDB as the database. The application reads and writes data to a DynamoDB table named 'Orders'. The table has a partition key 'OrderID' and a sort key 'OrderDate'. The application experiences high read latency during peak hours. The developer checks the CloudWatch metrics and notices high ReadThrottleEvents for the table. The table's read capacity is set to on-demand mode. The developer also notices that the application performs many queries that scan the entire table to find orders by customer ID, which is not a key attribute. What should the developer do to reduce read throttling?

Accepted Answer

Create a Global Secondary Index (GSI) on the CustomerID attribute and query the index instead of scanning the table.. Creating a Global Secondary Index (GSI) on CustomerID allows efficient queries without scanning the entire table, reducing read throttling. Option A is wrong because while DAX can reduce read load by caching, it does not address the root cause of scanning the table to find orders by customer ID; the application still performs inefficient scans that can cause throttling. Option B is wrong because switching to provisioned capacity and increasing read capacity units would increase cost and still not fix the inefficient query pattern; the table is already in on-demand mode which can handle traffic spikes, but throttling occurs due to inefficient data access. Option D is wrong because on-demand mode does not have a configurable maximum read capacity; it adjusts automatically based on traffic, but the real issue is the inefficient scanning.

Answer

Enable DynamoDB Accelerator (DAX) to cache the read results.

Answer

Switch the table to provisioned capacity mode and increase the read capacity units.

Answer

Keep the table in on-demand mode but increase the maximum read capacity limit.

Question 7

A company has a legacy application that generates log files on an EC2 instance. The developer needs to stream these log files to Amazon CloudWatch Logs in real time. The developer installed the CloudWatch agent on the EC2 instance and configured it to monitor the log files. However, the logs are not appearing in CloudWatch Logs. The developer checks the agent status and sees that the agent is running. What is the most likely cause of this issue?

Accepted Answer

The EC2 instance does not have an IAM role with the necessary CloudWatch Logs permissions.. The most likely cause is that the EC2 instance does not have an IAM role with the necessary CloudWatch Logs permissions. Even though the CloudWatch agent is running, it requires IAM permissions (such as logs:PutLogEvents, logs:CreateLogStream, and logs:DescribeLogStreams) to send log data to CloudWatch Logs. Without these permissions, the agent cannot write logs, causing them to not appear. Option A is incorrect because the CloudWatch agent supports various log file formats and a format mismatch would not prevent logs from appearing, though they might be parsed incorrectly. Option B is incorrect because the agent can use VPC endpoints or a NAT gateway to reach CloudWatch Logs without direct internet access. Option D is incorrect because the agent configuration file can specify a log group that does not yet exist; the agent can create it if it has the appropriate permissions.

Answer

The log file format is not compatible with the CloudWatch agent.

Answer

The EC2 instance is in a private subnet without internet access.

Answer

The CloudWatch agent configuration file does not specify an existing log group.

Question 8

A developer is implementing a solution to store application logs from multiple EC2 instances. The logs must be stored in a centralized location for analysis. Which services can the developer use to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it provides a centralized service for collecting, monitoring, and storing log data from EC2 instances. By installing the CloudWatch Logs agent on each EC2 instance, logs are automatically streamed to CloudWatch Logs, where they can be analyzed, searched, and retained for auditing or troubleshooting.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Analytics

Answer

Amazon DynamoDB

Question 9

A developer is using AWS Lambda to process records from an Amazon Kinesis Data Stream. The Lambda function is invoked with a batch of records. The function processes each record and then returns a response. The developer notices that some records are being processed multiple times. The function's execution time is within the Lambda timeout. The Kinesis stream has 10 shards. The developer wants to ensure that each record is processed exactly once. What should the developer do?

Accepted Answer

Modify the Lambda function to use the sequence number of each record to deduplicate processing.. Each record in a Kinesis stream has a unique sequence number within a shard. By storing the sequence numbers of processed records (e.g., in DynamoDB), the Lambda function can check if a record has already been processed before processing it, ensuring exactly-once processing. Option A is wrong because reducing the number of shards reduces throughput and does not eliminate duplicates; duplicates can still occur due to retries. Option C is wrong because configuring error handling to retry only failed records does not prevent duplicate processing of records that were successfully processed but are retried due to other reasons (e.g., batch failure). Option D is wrong because increasing the batch size does not address the root cause of duplicates; it only processes more records per invocation, but duplicates can still occur from overlapping invocations or retries.

Answer

Reduce the number of shards to minimize the chance of duplicates.

Answer

Configure the Lambda function's error handling to retry only failed records.

Answer

Increase the batch size to process more records per invocation.

Question 10

A developer is designing a serverless application that processes streaming data from IoT devices. The application must be able to handle data from millions of devices and store the data in a durable, scalable data store. Which AWS services should the developer use? (Choose THREE.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time streaming of large volumes of data, such as from millions of IoT devices. It can ingest and store data durably for up to 365 days, making it ideal for the ingestion layer of this serverless application.

Answer

Amazon RDS

Answer

Amazon SQS

Question 11

A developer is building a serverless application using AWS Lambda to process images uploaded to an S3 bucket. The Lambda function needs to resize each image and store the result in another S3 bucket. Which TWO actions should the developer take to ensure the function can access the S3 buckets securely?

Accepted Answer

Create an IAM execution role for the Lambda function with permissions to read from the source bucket and write to the destination bucket.. Lambda functions require an IAM execution role that grants permissions to access other AWS services. By creating a role with policies that allow s3:GetObject on the source bucket and s3:PutObject on the destination bucket, the function can securely read and write images without embedding long-term credentials.

Answer

Store the AWS access key and secret key in the Lambda environment variables.

Answer

Assign an IAM user to the Lambda function and embed the user's access key in the function code.

Answer

Attach an IAM instance profile to the Lambda function.

Question 12

A developer is using AWS CodeCommit as the source repository for a CI/CD pipeline. The developer wants to trigger a build automatically when changes are pushed to a specific branch. Which services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS CodeBuild. AWS CodeBuild can be configured to automatically start a build when changes are pushed to a specific branch in CodeCommit by using a webhook or by integrating with CodePipeline. CodePipeline can also trigger a build automatically by monitoring the CodeCommit repository for changes on a specified branch and then passing the source artifact to a build action. Both services provide direct mechanisms to initiate builds based on branch-specific commits.

Answer

Amazon CloudWatch Events

Answer

AWS CodeStar

Answer

AWS CodeDeploy

Question 13

A company uses Amazon API Gateway to expose a REST API backed by AWS Lambda. The API has a resource /items with GET and POST methods. The GET method returns items from a DynamoDB table. The POST method adds an item to the table. Currently, all methods are open to the public. Security requirements mandate that only authenticated users can access the POST method, while the GET method remains public. Which THREE steps should the developer take to meet these requirements?

Accepted Answer

Configure the Lambda authorizer only on the POST method in the API Gateway.. You can configure a Lambda authorizer at the method level in API Gateway, which allows you to selectively secure only the POST method while leaving the GET method public. This meets the requirement of restricting access to authenticated users for POST only, without affecting the public GET endpoint.

Answer

Use an Amazon Cognito User Pools authorizer for the entire API.

Answer

Add a resource policy that denies public access to the POST method.

Question 14

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload a file to s3://my-bucket/confidential/report.pdf. What will happen?

Accepted Answer

The upload fails because the Deny statement overrides the Allow.. IAM policy evaluation logic dictates that an explicit Deny always overrides any Allow. In this scenario, the Deny statement denies `s3:PutObject` on the path `arn:aws:s3:::my-bucket/confidential/*`, which matches the user's upload target `s3://my-bucket/confidential/report.pdf`. Even though the Allow statement grants `s3:PutObject` on `arn:aws:s3:::my-bucket/*`, the explicit Deny takes precedence, causing the upload to fail.

Answer

The upload succeeds because the Deny statement applies only to the bucket, not the user.

Answer

The upload fails because the policy does not allow PutObject on that path.

Answer

The upload succeeds because the Allow statement grants PutObject.

Question 15

Refer to the exhibit. A developer invoked a Lambda function and received the response shown. What does the response indicate?

Accepted Answer

The function was invoked but returned an error.. The response includes a 'FunctionError' field with value 'Unhandled' and an 'error' object, indicating that the Lambda function was invoked successfully (StatusCode 200) but the function itself encountered an error during execution. Option A is incorrect because a permissions error would result in a 4xx or 5xx StatusCode, not 200. Option B is incorrect because the function did not execute successfully—it returned an error. Option C is incorrect because a timeout would typically produce a 'null' FunctionError or a specific timeout error, not an explicit error object. Option D is correct: the function was invoked, but it returned an error.

Answer

The function was not invoked due to a permissions error.

Answer

The function executed successfully but did not return any logs.

Answer

The invocation timed out.