DVA-C02 Troubleshooting and Optimization Practice Test 12 — 15 Questions

Question 1

Which TWO are best practices for optimizing DynamoDB performance? (Choose two.)

Accepted Answer

Use SQS to decouple write-heavy workloads and handle spikes.. Using SQS to decouple write-heavy workloads allows DynamoDB to absorb traffic spikes by buffering writes in a queue, preventing throttling and enabling batch processing. This pattern, often called 'queue-based load leveling,' ensures that DynamoDB's provisioned capacity is not overwhelmed by sudden bursts, improving overall system resilience and cost efficiency.

Answer

Provision maximum write capacity units to handle any spike.

Answer

Use Scan operations instead of Query for retrieving data.

Answer

Enable strongly consistent reads for all read operations.

Question 2

A developer reports that an AWS Lambda function is timing out after 3 seconds. The function reads from an Amazon SQS queue. What is the most likely cause?

Accepted Answer

The Lambda function timeout is set to 3 seconds, which is too low.. The Lambda function is timing out after exactly 3 seconds because its configured timeout is set to 3 seconds, which is too low for the workload. Lambda has a maximum execution timeout of 15 minutes (900 seconds), but the default timeout is 3 seconds. Since the function reads from an SQS queue, it likely needs more time to process messages, and increasing the timeout value will resolve the issue.

Answer

The Lambda function memory is set too low, causing slow execution.

Answer

The Lambda execution role lacks permissions to poll SQS.

Answer

The SQS queue is empty, causing the function to wait indefinitely.

Question 3

An application running on Amazon ECS with Fargate is experiencing high latency. The application writes logs to Amazon CloudWatch Logs. Which AWS service can be used to analyze the logs to pinpoint the cause of the latency?

Accepted Answer

Amazon CloudWatch Logs Insights. Amazon CloudWatch Logs Insights is the correct choice because it is purpose-built for interactively querying and analyzing log data stored in CloudWatch Logs. It allows you to run SQL-like queries (using a query language) to filter, aggregate, and visualize log events, which is essential for pinpointing latency patterns, such as slow API calls or database queries, without needing to export logs to another service.

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Answer

Amazon S3

Question 4

A developer is troubleshooting a slow Amazon DynamoDB table. The table has a read capacity of 1000 RCU and a write capacity of 500 WCU. The application frequently reads the same item. Which TWO actions can improve read performance?

Accepted Answer

Implement DynamoDB Accelerator (DAX) for caching.. DynamoDB Accelerator (DAX) is an in-memory cache that can reduce read latency for frequently accessed items from milliseconds to microseconds, offloading read traffic from the table and improving performance without requiring a capacity increase. Option E is correct because eventually consistent reads consume half the RCU of strongly consistent reads (0.5 RCU vs 1 RCU per 4 KB item) and return data faster, which is suitable when the application can tolerate slightly stale data for the same item.

Answer

Increase the read capacity units (RCU) to 2000.

Answer

Add a Global Secondary Index (GSI) on the frequently read attribute.

Answer

Decrease the write capacity units (WCU) to 250.

Question 5

A web application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. Which TWO steps should be taken to diagnose the issue?

Accepted Answer

Check the CPU utilization of the EC2 instances.. High CPU utilization on EC2 instances can cause them to become unresponsive or fail to respond to health checks within the ALB's configured timeout, leading to 503 errors. The ALB routes traffic only to healthy targets; if instances are overwhelmed, they may fail health checks or drop requests, resulting in a 503 response to clients.

Answer

Check the Route 53 health checks for the domain.

Answer

Check the security group rules for the ALB.

Answer

Check the EBS volume type of the EC2 instances.

Question 6

A developer is troubleshooting an AWS CloudFormation stack that failed to create. The error message says 'The following resource(s) failed to create: [MyEC2Instance]'. What is the first step the developer should take?

Accepted Answer

View the stack events in the CloudFormation console to see the specific error for the resource.. When a CloudFormation stack fails to create, the error message only indicates which resource failed, not why. The first troubleshooting step is to view the stack events in the CloudFormation console, which provides detailed error messages for each resource, such as an API call failure, insufficient permissions, or a resource limit exceeded. This allows the developer to diagnose the root cause before making any changes.

Answer

Update the stack with a new template.

Answer

Delete the stack and try again.

Answer

Review the CloudFormation template for syntax errors.

Question 7

An application running on Amazon ECS with Fargate is unable to pull an image from Amazon ECR. The task definition uses the 'default' task execution role. What is the most likely cause?

Accepted Answer

The task execution role does not have permissions to pull from ECR.. When using Amazon ECS with Fargate, the task execution role (not the task role) is responsible for pulling container images from Amazon ECR. The 'default' task execution role is created automatically but lacks the necessary permissions (e.g., ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:BatchCheckLayerAvailability) unless explicitly attached via an IAM policy. Since the question states the task definition uses the 'default' task execution role, the most likely cause is that this role does not have the required ECR permissions.

Answer

The task role does not have permissions to access ECR.

Answer

The ECS cluster does not have permissions to access ECR.

Answer

The ECS service role does not have permissions to access ECR.

Question 8

Refer to the exhibit. An IAM policy is attached to a user. The user tries to download an object from s3://my-bucket/secret/config.txt. What will happen?

Accepted Answer

The user is denied access because the Deny statement explicitly denies access to the 'secret/' prefix.. The Deny statement explicitly denies all s3 actions on the 'secret/' prefix. Deny statements override Allow statements. Therefore, the user is denied access to objects under the 'secret/' prefix, including s3://my-bucket/secret/config.txt. Option D is correct. Option A is incorrect because the explicit Deny overrides any bucket policy allow. Option B is incorrect because the Deny applies to all s3 actions, including s3:GetObject, and is scoped to the 'secret/' prefix. Option C is incorrect because the Allow statement does not grant access to the 'secret/' prefix; the Deny overrides it.

Answer

The user is denied access only if the bucket policy also denies access.

Answer

The user can download the object because the Deny statement only applies to 's3:*' actions, not s3:GetObject.

Answer

The user can download the object because the Allow statement grants s3:GetObject on the bucket.

Question 9

Refer to the exhibit. A developer runs the AWS CLI command for an EC2 instance. The instance is in the 'running' state, but the application hosted on it is not reachable. What should the developer check first?

Accepted Answer

Check the security group rules for inbound traffic.. When an EC2 instance is in the 'running' state but the application is unreachable, the most common initial cause is that the Security Group associated with the instance does not allow inbound traffic on the application's port (e.g., port 80 or 443). Security groups act as stateful firewalls at the instance level, and by default, they block all inbound traffic unless explicitly allowed.

Answer

Check the ELB health check settings.

Answer

Check the instance status checks in the EC2 console.

Answer

Verify the instance ID is correct.

Question 10

A developer is using Amazon S3 to host a static website. The website returns 403 Forbidden errors. The bucket policy allows public read access. What is the most likely cause?

Accepted Answer

The bucket's 'Block public access' settings are enabled.. The most likely cause is that the bucket's 'Block public access' settings are enabled. Even if the bucket policy explicitly grants public read access, S3's Block Public Access settings act as an overarching security override that denies all public requests, resulting in a 403 Forbidden error. These settings are enabled by default for new buckets and can be applied at the account or bucket level, making them a common pitfall.

Answer

The bucket has an ACL that denies read access.

Answer

The bucket policy does not include the 's3:GetObject' action.

Answer

The bucket policy is not correctly attached to the bucket.

Question 11

A developer is troubleshooting a slow Amazon RDS for MySQL database. The application experiences high latency on write operations. Which TWO actions can improve write performance?

Accepted Answer

Increase the allocated storage size to get better I/O performance.. Option B is correct because Amazon RDS storage performance is tied to the allocated storage size: increasing the allocated storage (especially into higher gp2/gp3 or io1/io2 tiers) raises the available IOPS and throughput, which directly reduces write latency. Option D is correct because moving to a larger DB instance class provides more vCPU, memory, and dedicated EBS bandwidth, allowing the database to process write operations faster and relieve resource contention. Option A is not correct because a read replica only offloads read traffic and does not improve write performance on the primary. Option C is not correct because deletion protection is a safety feature that prevents accidental deletion and has no effect on I/O performance. Option E is not correct because Multi-AZ provides high availability via synchronous standby replication, not write performance improvement; in fact, it can add slight write overhead.

Answer

Add a read replica to offload read traffic.

Answer

Enable deletion protection.

Answer

Enable Multi-AZ deployment for high availability.

Question 12

Refer to the exhibit. A CloudFormation stack creation failed. What is the most likely cause of the failure?

Accepted Answer

The IAM role's trust policy does not allow Lambda to assume the role.. The IAM role's trust policy does not allow Lambda to assume the role. In CloudFormation, when a stack provisions a Lambda function with an execution role, the role's trust policy must include lambda.amazonaws.com as a principal with sts:AssumeRole; if that trust relationship is missing or misconfigured, role assumption fails and the stack creation fails. Option B is unlikely because Lambda function names only need to be unique within an account and Region, and CloudFormation would typically surface a naming conflict differently. Option C is not the most likely cause because a code syntax error usually causes invocation failures after deployment, not stack creation failure. Option D would cause runtime logging failures, but the role could still be assumed and the function created, so it would not typically fail the stack at creation time.

Answer

The Lambda function name conflicts with an existing function.

Answer

The Lambda function code has a syntax error.

Answer

The Lambda execution role does not have the required permissions to write to CloudWatch Logs.

Question 13

A developer is troubleshooting an AWS Lambda function that is timing out. The function processes S3 events and writes to DynamoDB. The average execution time is 5 seconds, but the function times out after 3 seconds. What is the most likely cause?

Accepted Answer

The Lambda function timeout is set to 3 seconds.. The function's average execution time is 5 seconds, but it times out at 3 seconds — this mismatch directly indicates the Lambda function's configured timeout value is set to 3 seconds, which is lower than the actual runtime. The timeout setting is a per-function configuration (default 3 seconds, max 15 minutes) that terminates execution when exceeded. Since the workload legitimately needs ~5 seconds, the fix is to increase the timeout to a value above the observed runtime.

Answer

The S3 bucket is not configured to send event notifications.

Answer

DynamoDB write capacity is insufficient.

Answer

The Lambda function concurrency limit is exceeded.

Question 14

A developer is using AWS CodeBuild to build a Java application. The build fails with 'OutOfMemoryError'. Which configuration change would most likely resolve this issue?

Accepted Answer

Increase the compute type to a larger instance size.. CodeBuild allows configuring the compute type (e.g., BUILD_GENERAL1_MEDIUM, BUILD_GENERAL1_LARGE) which determines the memory and CPU available. An 'OutOfMemoryError' indicates insufficient memory, so increasing the compute type to a larger instance size provides more memory and resolves the issue. Option A is incorrect because CodeBuild does not support custom AMIs; it uses managed container images. Option B is incorrect because enabling detailed CloudWatch logs only increases logging, not memory. Option D is incorrect because splitting the build adds complexity and does not address the memory shortage in the current build.

Answer

Use a custom AMI with more memory.

Answer

Enable detailed CloudWatch logs for the build.

Answer

Split the build into multiple CodeBuild projects.

Question 15

An application running on Amazon ECS Fargate is experiencing intermittent connection timeouts when calling an external API. The task has a public IP and a security group that allows outbound HTTPS. What is the most likely cause?

Accepted Answer

The task is running in a private subnet without a NAT gateway.. ECS Fargate tasks running in a private subnet do not have direct internet access. Without a NAT gateway, outbound traffic to the external API is routed to the subnet’s route table, which lacks an internet gateway target, causing connection timeouts. The task’s public IP assignment is irrelevant in a private subnet, as the subnet itself has no route to the internet.

Answer

The ECS service is not configured to auto-assign public IP.

Answer

The task's security group does not allow inbound traffic.

Answer

The security group outbound rules are misconfigured.