DVA-C02 Troubleshooting and Optimization Practice Test 10 — 15 Questions

Question 1

A developer receives an Access Denied error when trying to download an object from an S3 bucket. The developer's IAM policy is shown in the exhibit. The bucket policy also grants access. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket uses SSE-KMS and the user lacks kms:Decrypt permission.. If the bucket is encrypted with a KMS key, the user must also have kms:Decrypt permission. Option A is wrong because the policy explicitly allows s3:GetObject. Option C is wrong because the bucket policy also grants access, so it's not a bucket policy issue. Option D is wrong because public access is not required if IAM policies allow access.

Answer

The S3 bucket has block public access enabled.

Answer

The IAM policy does not allow s3:GetObject.

Answer

The bucket policy denies access to the user.

Question 2

A developer is creating an ECS task definition using the JSON shown in the exhibit. The task fails to run with an error about insufficient memory. What is the issue?

Accepted Answer

The task memory and cpu values are specified as strings instead of integers.. The error about insufficient memory occurs because the task definition specifies 'memory' and 'cpu' as strings (e.g., '512' and '256') instead of integers. ECS requires these values to be integers. Option A is incorrect because port mapping is unrelated to memory. Option B is incorrect because network mode defaults to 'bridge' and is not required to be explicitly set. Option D is incorrect because container memory (256) is less than task memory (512), which is valid and not the cause of the failure.

Answer

The container port is not mapped to a host port.

Answer

The task definition does not specify a network mode.

Answer

The container memory is less than the task memory.

Question 3

A Lambda function is timing out after 3 seconds when processing an S3 event. The function reads a file from S3 and writes to DynamoDB. The timeout is set to 5 seconds. What is the MOST likely cause of the timeout?

Accepted Answer

The function is attached to a VPC without a NAT gateway, causing network timeouts when accessing S3 and DynamoDB.. The function is timing out at 3 seconds even though the configured timeout is 5 seconds. The most likely cause is that the function is attached to a VPC without a NAT gateway. In such a configuration, the Lambda function cannot access public AWS services like S3 and DynamoDB over the internet, causing network calls to hang until the function's timeout is reached. Option A correctly identifies this scenario. Option B (insufficient DynamoDB write capacity) would result in throttling errors (e.g., ProvisionedThroughputExceededException) but not a timeout. Option C (low memory) might cause slower execution but not a hard timeout at exactly 3 seconds. Option D (reserved concurrency limit) would cause requests to be throttled with a 429 error, not a timeout.

Answer

DynamoDB write capacity is insufficient, causing write requests to be throttled.

Answer

The function's memory allocation is too low, causing CPU throttling.

Answer

The function is hitting the reserved concurrency limit and being throttled.

Question 4

A developer is troubleshooting an application that uses Amazon SQS. Messages are being sent to a dead-letter queue (DLQ) after the maximum receive count is exceeded. The consumer processes messages but sometimes fails. The developer wants to ensure that messages are retried immediately after a failure, without waiting for the visibility timeout. Which solution should the developer implement?

Accepted Answer

After a failure, call ChangeMessageVisibility with a timeout of 0 to make the message immediately available for reprocessing.. The correct solution is to call ChangeMessageVisibility with a timeout of 0 after a failure. This makes the message immediately available for reprocessing by other consumers, effectively retrying without waiting for the visibility timeout. Option A (delay queue) introduces a delay, which is counterproductive. Option C (delete and re-send) loses original message attributes and is inefficient. Option D (increase visibility timeout) would delay retries, not accelerate them.

Answer

Configure a delay queue so that messages are not immediately visible after failure.

Answer

Delete the message from the queue and re-send it after processing failure.

Answer

Increase the visibility timeout to allow more time for processing.

Question 5

A developer is using AWS CodeBuild to build a Java application. The build succeeds locally but fails on CodeBuild with a 'Cannot find symbol' error for a class that is in a dependency JAR. What is the MOST likely cause?

Accepted Answer

The dependency cache is not enabled in CodeBuild, so dependencies are not available.. CodeBuild by default does not include cached dependencies; each build downloads dependencies from scratch unless a cache is configured. The local build works because Maven/Gradle caches dependencies locally. Option A (build timing out before dependencies are fully downloaded) would cause an incomplete download, but CodeBuild typically fails on download errors, not missing symbols after successful download. Option B (insufficient compute memory) might cause out-of-memory errors during compilation, not a 'Cannot find symbol' error. Option D (incorrect buildspec syntax) would cause a build failure earlier, not a compilation error. Therefore, the most likely cause is that dependency caching is not enabled, leading to missing cached dependencies.

Answer

The build is timing out before dependencies are fully downloaded.

Answer

The CodeBuild compute type does not have enough memory to compile the project.

Answer

The buildspec file has incorrect syntax causing the build to skip dependency resolution.

Question 6

An application running on Amazon ECS Fargate is experiencing intermittent high latency and timeout errors. The application makes API calls to an external third-party service. The ECS service is configured with a target group using HTTP health checks. The ALB health check logs show occasional 503 responses. What is the MOST likely cause?

Accepted Answer

The application is not properly handling timeouts to the third-party service, causing the health check endpoint to hang.. The application's health check endpoint is likely dependent on calls to the third-party service. When the third-party service is slow or unresponsive, the health check endpoint hangs, causing the ALB to receive 503 responses (health check failures). This is intermittent because the third-party service occasionally experiences high latency. Other options are less likely: security group issues would cause consistent failures (not intermittent), CPU credits are not applicable to Fargate, and task placement strategies would not directly cause 503s from health checks.

Answer

The security group for the ECS tasks is blocking inbound traffic from the ALB.

Answer

The ECS tasks are running out of CPU credits, causing slow response times.

Answer

The ECS service is configured with a task placement strategy that is causing tasks to be stopped and restarted frequently.

Question 7

A developer is using AWS CloudFormation to deploy a stack. The stack creation fails with the error 'API: iam:CreateRole User: arn:aws:iam::123456789012:user/DevUser is not authorized to perform: iam:CreateRole'. The developer is using an IAM user with AdministratorAccess policy attached. What is the MOST likely cause of this error?

Accepted Answer

The CloudFormation stack is using a service role that does not have iam:CreateRole permission.. The error indicates that the IAM user 'DevUser' is not authorized to perform iam:CreateRole, despite having an AdministratorAccess policy attached. The most likely cause is that the CloudFormation stack is using a service role, and that service role does not have the iam:CreateRole permission. CloudFormation uses the service role's permissions, not the user's, when creating resources. If the service role lacks the required permission, the operation fails. Option A is incorrect because hitting the IAM role limit would produce a 'limit exceeded' error. Option C is incorrect because IAM is a global service and is supported in all regions. Option D is incorrect because the AdministratorAccess policy is an AWS managed policy that includes full IAM permissions; if it were modified, it would no longer be AdministratorAccess.

Answer

The account has reached the IAM role limit.

Answer

The CloudFormation stack is being created in a region where IAM is not supported.

Answer

The AdministratorAccess policy has been modified to remove IAM permissions.

Question 8

A developer deployed a new version of a Lambda function using an alias that points to the new version. However, the function continues to invoke the old version. What is the MOST likely cause?

Accepted Answer

The alias was not updated to point to the new version after deployment.. If the alias is not updated to point to the new version, it still invokes the old version. Option A is incorrect because IAM execution role permissions do not affect which version is invoked; they affect whether the function can be invoked at all. Option C is incorrect because reserved concurrency set to 0 would cause throttle errors, not invocation of old code. Option D is incorrect because a different function name would result in a resource not found error, not invoking old code.

Answer

The IAM execution role for the Lambda function does not have permission to invoke the new version.

Answer

The Lambda function's reserved concurrency is set to 0, preventing new invocations.

Answer

The function name in the invocation request is different from the deployed function.

Question 9

A company uses Amazon S3 to store sensitive data. A developer needs to ensure that all objects uploaded to a specific S3 bucket are encrypted at rest. Which approach should the developer take?

Accepted Answer

Add a bucket policy that denies PutObject if the object is not encrypted.. A bucket policy can deny PutObject requests if the object is not encrypted, ensuring that all uploads are encrypted at rest. Option B (pre-signed URLs) does not enforce encryption. Option C (IAM policy) is not bucket-specific and can be cumbersome. Option D (default encryption) encrypts objects without explicit encryption but does not prevent unencrypted uploads if the client explicitly overrides (e.g., using SSE-C with a different key). The bucket policy is the most reliable enforcement mechanism.

Answer

Use pre-signed URLs with server-side encryption parameters.

Answer

Attach an IAM policy to all users requiring them to include the x-amz-server-side-encryption header.

Answer

Enable default encryption on the bucket using SSE-S3.

Question 10

A developer is troubleshooting a CloudFront distribution that serves static content from an S3 bucket. Users in some geographic locations report slow load times. The developer checks the CloudFront metrics and sees a high number of cache misses. What is the MOST likely cause?

Accepted Answer

The object TTL is set to a very low value (e.g., 0 seconds).. A very low TTL (e.g., 0 seconds) causes objects to expire from CloudFront edge caches almost immediately, resulting in frequent cache misses and increased requests to the origin. Option A (Price Class 100) limits edge locations to US and Europe, which could cause slower load times in other regions, but it does not directly cause a high number of cache misses—cache misses occur when objects are not in the edge cache, regardless of region. Option B (signed URLs) does not inherently cause a high miss rate; signed URLs control access but do not affect cache behavior. Option C (compression) improves performance but does not affect cache hit rate.

Answer

The CloudFront distribution is configured with Price Class 100, which uses only the US and Europe edge locations.

Answer

The S3 bucket is configured with signed URLs for access.

Answer

The CloudFront distribution is not configured to compress objects.

Question 11

A developer is investigating why an Amazon API Gateway REST API is returning 504 errors during peak traffic. The API integrates with a Lambda function. Which TWO factors are MOST likely causing the 504 errors? (Choose TWO.)

Accepted Answer

The Lambda function is hitting its reserved concurrency limit and being throttled.. Options A and D are correct. Option A: If the Lambda function hits its reserved concurrency limit and is throttled, API Gateway receives a 429 from Lambda and returns a 504 error to the client. Option D: If the Lambda function's configured timeout is too short, it may timeout before the API Gateway integration timeout (29 seconds), causing a 504. Option B is incorrect because a full cache does not cause 504 errors. Option C is incorrect because AWS WAF blocking would result in a 403 Forbidden, not a 504. Option E is incorrect because exceeding API Gateway account-level throttling limits would cause 429 Too Many Requests, not 504.

Answer

The API Gateway cache is full and cannot store responses.

Answer

The AWS WAF is blocking the request.

Answer

The API Gateway account-level throttling limits are exceeded.

Question 12

A developer is optimizing an application that uses Amazon DynamoDB. The application reads items by primary key and also performs queries on a Global Secondary Index (GSI). The developer notices that some queries on the GSI are slow. Which TWO actions would improve the performance of GSI queries? (Choose TWO.)

Accepted Answer

Use a more distributed GSI partition key to avoid hot partitions.. Option A is correct because using a more distributed GSI partition key avoids hot partitions, which prevents throttling and improves query performance.

Option C is correct because in DynamoDB, Global Secondary Indexes (GSIs) have their own provisioned read and write capacity units (RCUs and WCUs) separate from the base table. If GSI queries are slow due to throttling, increasing the read capacity of the GSI will resolve the issue.

Option B is incorrect because ensuring the GSI key attribute exists on all items makes them present in the index (avoiding a sparse index), which is a functional requirement for data visibility rather than a performance optimization. In fact, sparse indexes can sometimes improve performance by reducing the index size.

Option D is incorrect because GSIs only support eventually consistent reads.

Option E is incorrect because increasing the write capacity of the base table does not improve GSI read performance.

Answer

Ensure that the GSI key attribute exists on all items that need to be queried.

Answer

Use strongly consistent reads on the GSI.

Answer

Increase the write capacity of the DynamoDB table.

Question 13

A company is using Amazon ElastiCache for Redis to improve the performance of a high-traffic web application. Recently, the application has been experiencing increased latency. The developer suspects that cache misses are causing the application to read from the database more frequently. Which THREE metrics should the developer examine in Amazon CloudWatch to troubleshoot this issue? (Choose THREE.)

Accepted Answer

CacheMisses. To troubleshoot increased latency due to cache misses, the developer should examine CacheMisses (A) to directly see the number of cache misses, Evictions (B) to identify keys removed due to memory pressure that could cause further misses, and CurrConnections (D) to check for connection bottlenecks that might slow down cache access. SwapUsage (C) indicates memory swapping, which is not directly related to cache efficiency, and CPUUtilization (E) is not a primary metric for cache hit ratio issues.

Answer

SwapUsage

Answer

CPUUtilization

Question 14

A developer is deploying a web application on Amazon ECS with Fargate. The application needs to store session state. Which THREE options are suitable for storing session state in a distributed environment? (Choose THREE.)

Accepted Answer

Amazon RDS for MySQL. Options B, D, and E are correct. Amazon RDS for MySQL (B) can store session state in a distributed environment because it provides a centralized, durable data store accessible from all tasks. However, it may introduce overhead due to relational schema and connection management. Amazon DynamoDB (D) is a fully managed NoSQL database with low latency and high scalability, making it an excellent choice for session state storage. Amazon ElastiCache for Redis (E) is an in-memory data store commonly used for session caching due to its speed and support for data structures like hashes. Options A and C are incorrect. Amazon S3 (A) is object storage with higher latency and not designed for frequent read/write of small session data. Local ephemeral storage on Fargate (C) is not shared across tasks, so it cannot persist session state when tasks scale or fail.

Answer

Amazon S3

Answer

Local ephemeral storage on the Fargate task

Question 15

A developer has attached the IAM policy shown in the exhibit to a user. The user reports that they can upload and delete objects in the bucket 'my-bucket', but cannot list the objects in the bucket. What is the MOST likely reason?

Accepted Answer

The bucket has a bucket policy that denies s3:ListBucket.. The IAM policy provides s3:ListBucket permission on the bucket, so the user should be able to list objects. However, bucket policies can explicitly deny actions, and an explicit deny overrides any allow. Therefore, the most likely reason is that the bucket policy denies s3:ListBucket. Option A is incorrect because s3:GetObject is for reading individual objects, not listing. Option C is incorrect because the API call version does not affect permissions. Option D is incorrect because region does not affect IAM permissions.

Answer

The IAM policy is missing the s3:GetObject permission for listing.

Answer

The user is using the ListObjectsV2 API call instead of ListObjects.

Answer

The bucket is in a different region than the default region configured in the AWS CLI.