DVA-C02 Troubleshooting and Optimization Practice Test 12 — 15 Questions

Question 1

A company's DynamoDB table has a read capacity of 10,000 RCUs and receives consistent traffic. Recently, users have reported increased latency for read requests. The application uses strongly consistent reads. The developer checks CloudWatch metrics and sees that 'ConsumedReadCapacityUnits' is at 9,500 but 'ThrottledRequests' is high. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A hot partition is exceeding its partition-level read capacity.. The high 'ThrottledRequests' despite table-level consumed capacity (9,500 RCUs) being below provisioned capacity (10,000 RCUs) indicates a hot partition. DynamoDB partitions data by partition key, and each partition has a maximum throughput of 3,000 RCUs (or 1,000 WCUs). If one partition receives a disproportionate share of reads, that partition can be throttled even when overall table capacity is not exhausted. Strongly consistent reads consume double RCUs, but the key here is partition-level imbalance. Option B is correct. Option A is incorrect because the application is using strongly consistent reads correctly. Option C is incorrect: auto scaling would not cause throttling when capacity is sufficient; it would scale up if needed. Option D is incorrect because the table-level RCUs are adequate; the issue is distribution.

Answer

The application is using eventually consistent reads but expecting strongly consistent results.

Answer

The DynamoDB table has auto scaling enabled and is scaling down too aggressively.

Answer

The provisioned read capacity is too low for the traffic.

Question 2

A developer is deploying a new version of a Lambda function using AWS CodeDeploy. The deployment fails with a 'DeploymentLimitExceeded' error. What is the most likely cause?

Accepted Answer

The deployment group has reached the maximum number of concurrent deployments.. AWS CodeDeploy enforces a limit on the number of concurrent deployments per deployment group. The 'DeploymentLimitExceeded' error indicates that this limit has been reached. Therefore, option A is correct. Option D is incorrect because the error is not related to insufficient IAM permissions—that would result in an 'AccessDenied' or similar error. Option B is incorrect because Lambda version limits are separate from deployment limits. Option C is incorrect because concurrent deployments are allowed for different deployment groups or functions, but the limit applies per deployment group.

Answer

The Lambda function has reached the maximum number of versions.

Answer

Another deployment is in progress for the same Lambda function.

Answer

The IAM role for CodeDeploy does not have sufficient permissions.

Question 3

A developer is troubleshooting an EC2 instance that is unreachable via SSH. The instance passed the status checks, and the security group allows SSH from the developer's IP. What should the developer check next?

Accepted Answer

The network ACL's outbound rules.. The network ACL is stateless and must allow both inbound and outbound traffic. In this case, the inbound rule allows SSH (port 22), but the outbound rule for ephemeral ports (1024-65535) must also be allowed for the return traffic. Option C is correct because the network ACL's outbound rules are often overlooked. Option A is wrong because security groups are stateful and automatically allow return traffic. Option B is wrong because the route table does not affect direct SSH connectivity if the instance has a public IP and the internet gateway is properly configured. Option D is wrong because the instance passed status checks, indicating the OS is running.

Answer

The security group's outbound rules.

Answer

The route table for the subnet.

Answer

The instance's system log for kernel errors.

Question 4

A developer is using AWS CloudFormation to deploy a stack. The stack creation fails with a 'CREATE_FAILED' status for an EC2 instance resource. The event message says 'The requested configuration is currently not supported. Please check the documentation for supported configurations.' What should the developer do to resolve this issue?

Accepted Answer

Change the instance type or specify a different Availability Zone in the template.. The error 'The requested configuration is currently not supported' indicates that the specified instance type is not available in the chosen Availability Zone. To resolve this, the developer should modify the CloudFormation template to change the instance type to one that is supported in that AZ, or specify a different Availability Zone that supports the original instance type, then update the stack. Option C (change the instance type or specify a different Availability Zone) directly addresses this issue. Option A is incorrect because simply updating a parameter value without changing the instance type or AZ will not fix the unsupported configuration. Option B is irrelevant as the error is about hardware compatibility, not permissions. Option D is wrong because the AMI is not the cause; the instance type/AZ combination is unsupported regardless of the AMI.

Answer

Update the stack with a new parameter value.

Answer

Add an IAM role to the EC2 instance.

Answer

Use a different Amazon Machine Image (AMI).

Question 5

A company's API Gateway REST API is experiencing high latency. The API integrates with a Lambda function that queries an RDS database. The developer notices that the Lambda function's duration metric is low, but the API Gateway integration latency is high. What is the most likely cause?

Accepted Answer

The Lambda function is in a VPC, causing additional network hops.. API Gateway integration latency includes network overhead between API Gateway and the Lambda function. Option B is correct because if the Lambda function is in a VPC, API Gateway must traverse additional network hops to reach it, increasing latency. Option A is incorrect because a concurrency limit would cause throttling errors, not just high latency, and the Lambda duration metric is low. Option C is incorrect because cache misses would increase latency but not specifically the integration latency; moreover, cache hits would reduce latency for cached responses. Option D is incorrect because the RDS database is not directly queried by API Gateway; the Lambda function queries the database, and its duration is low, so database region is not the cause.

Answer

The Lambda function has reached the concurrency limit.

Answer

The API Gateway cache is enabled and causing a cache miss for every request.

Answer

The RDS database is in a different region than the API Gateway.

Question 6

A developer is using SQS to decouple microservices. The producer sends messages, but the consumer (an EC2 instance) does not process them. The CloudWatch metric 'ApproximateNumberOfMessagesVisible' is increasing. The consumer's IAM role has 'sqs:ReceiveMessage' and 'sqs:DeleteMessage' permissions. What is the most likely cause?

Accepted Answer

The consumer is not using long polling, so calls to ReceiveMessage return empty frequently.. The key issue is that the consumer is not using long polling. With short polling (default), `ReceiveMessage` queries only a subset of servers and may return empty even if messages exist. Enabling long polling (`WaitTimeSeconds` > 0) reduces empty responses and ensures that the consumer actually receives messages. While permissions and DLQ configuration are possible issues, the given IAM permissions are sufficient (they include `ReceiveMessage` and `DeleteMessage`), and the DLQ would only receive messages after the max receive count is exceeded, but messages remain visible. SSE-KMS encryption requires additional KMS permissions, but that would cause access denied errors, not just visible messages increasing. The increasing `ApproximateNumberOfMessagesVisible` indicates messages are not being consumed, and assuming the consumer is running, the most likely cause is that it is not effectively receiving messages due to short polling.

Answer

A dead-letter queue is configured and messages are being moved there.

Answer

The consumer does not have permission to call 'sqs:ReceiveMessage'.

Answer

The queue is encrypted with SSE, and the consumer does not have permission to use the KMS key.

Question 7

A developer is troubleshooting a slow-running application that uses ElastiCache for Redis as a caching layer. The application frequently reads and writes data to the cache. Which TWO actions should the developer take to improve cache performance?

Accepted Answer

Use optimized data structures like hashes instead of strings for complex data.. Using optimized data structures like hashes instead of strings reduces memory and CPU overhead for complex data, improving cache performance. Option E is correct because enabling ElastiCache auto scaling allows the cluster to adjust the number of nodes based on demand, preventing performance degradation during traffic spikes. Option B is incorrect: LRU eviction policy helps manage memory when full but is not a performance optimization for read/write operations. Option C is incorrect: disabling persistence (appendonly no) improves write performance but is not the primary issue for a slow application and may affect data durability. Option D is incorrect: increasing shards distributes data but does not directly improve performance if the bottleneck is CPU or memory; auto scaling is a more targeted solution.

Answer

Configure the cache to use LRU eviction policy.

Answer

Disable persistence by setting appendonly to no.

Answer

Increase the number of shards to distribute data.

Question 8

A company is using CloudFront with an S3 origin to serve static content. Users in some geographic regions experience high latency. The developer wants to optimize performance. Which THREE actions should the developer take?

Accepted Answer

Increase the TTL for the cache behavior to reduce requests to the origin.. Increasing TTL (Time to Live) reduces the number of requests to the origin, which can decrease latency for users by serving content from edge caches more often. Option B is wrong: S3 Transfer Acceleration is designed for fast uploads to S3, not for improving CloudFront delivery; it does not reduce latency for static content served via CloudFront. Option C is correct: CloudFront Origin Shield acts as a caching layer that reduces the load on the origin and can improve performance by consolidating requests. Option D is correct: configuring multiple origins and setting up origin failover can improve availability and reduce latency by routing requests to a healthy origin closer to the user. Option E is wrong: CloudFront already has a global network of edge locations; you cannot add additional edge locations yourself. The existing edge locations are sufficient; the issue is likely origin-related.

Answer

Enable S3 Transfer Acceleration for the origin bucket.

Answer

Add additional CloudFront edge locations in the affected regions.

Question 9

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application stores session data in an RDS MySQL database. Recently, users have reported that they are being logged out unexpectedly and their session data is lost. The developer investigates and finds that the RDS instance's CPU utilization spikes periodically, coinciding with the logout events. The application uses connection pooling via an RDS Proxy. The developer suspects that the session table is being dropped or truncated. After checking the application logs, the developer finds no evidence of truncation commands. The RDS instance has automated backups enabled, and the binary logs are retained for 24 hours. The developer wants to identify the root cause and prevent future occurrences. Which course of action should the developer take?

Accepted Answer

Check the session table's storage engine; if it uses MEMORY, change it to InnoDB to persist data across restarts.. The RDS CPU spikes coinciding with session loss suggest that the database is being restarted or failing over. If the session table uses the MEMORY storage engine, its data is lost when the instance restarts, causing users to be logged out. The developer should check the storage engine of the session table and change it to InnoDB to persist data across restarts. Option A is incorrect because Multi-AZ improves availability but does not prevent data loss from in-memory tables. Option B is incorrect because increasing instance size may reduce CPU spikes but does not address the root cause of data loss. Option C is incorrect because disabling RDS Proxy is unnecessary; connection pooling is not the issue.

Answer

Enable Multi-AZ deployment for RDS to improve availability and prevent data loss during failover.

Answer

Increase the RDS instance size to handle the CPU spikes and prevent future issues.

Answer

Disable RDS Proxy and implement connection pooling in the application code to reduce database load.

Question 10

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and several Lambda functions. The developer runs 'sam deploy' and the deployment succeeds. However, when the developer tests the API endpoint using curl, the request times out. The CloudWatch logs for the Lambda function show that the function is not being invoked. The API Gateway logs are not enabled. The developer checks the API Gateway console and sees that the integration type is 'AWS Service' instead of 'Lambda Function'. The developer used the following SAM template snippet:

Resources:
  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      DefinitionBody:
        swagger: 2.0
        info:
          title: My API
        paths:
          /items:
            get:
              x-amazon-apigateway-integration:
                type: aws_proxy
                uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFunction.Arn}/invocations
              responses: {}
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src
      Handler: index.handler
      Runtime: nodejs14.x
      Events:
        ApiEvent:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /items
            Method: GET

What is the most likely cause of the timeout?

Accepted Answer

The API Gateway integration type is misconfigured; the SAM template should use 'AWS::Serverless::Function' event source instead of manual Swagger integration.. The SAM template defines the API using both the 'AWS::Serverless::Api' resource with a Swagger definition inline and the 'AWS::Serverless::Function' with an Api event. This may cause a conflict or incorrect configuration. Option D is correct: the 'x-amazon-apigateway-integration' type is set to 'aws_proxy' but the URI is incorrect. However, the API Gateway integration type shown as 'AWS Service' indicates that the integration was not properly set up. The most likely cause is that the SAM template incorrectly defines the integration, leading to a misconfiguration. Option A is wrong because the timeout is not due to Lambda limits. Option B is wrong because the code is not invoked. Option C is wrong because the API is correctly set up for public access.

Answer

The API Gateway endpoint is not publicly accessible due to a resource policy.

Answer

The Lambda function's code is throwing an unhandled exception before it can log.

Answer

The Lambda function has reached the concurrency limit.

Question 11

A developer notices that an S3 bucket's 'PutObject' API calls are failing intermittently for a specific application. The application uses the AWS SDK for Java to upload files. The error message is 'RequestTimeout: Your socket connection to the server was not read from or written to within the timeout period.' The bucket is in the same region as the application. The developer checks the S3 metrics and sees no throttling errors. The application runs on EC2 instances behind an ALB. The developer suspects a network issue. What should the developer do to resolve the issue?

Accepted Answer

Increase the socket timeout in the AWS SDK configuration and ensure the network path (ALB) has a higher idle timeout.. The 'RequestTimeout' error indicates that the connection was idle for too long. Since the application runs on EC2 behind an ALB, the ALB's idle timeout may be shorter than the S3 SDK's timeout, causing the socket connection to be closed prematurely. Increasing the socket timeout in the AWS SDK configuration and ensuring the ALB has a higher idle timeout resolves the issue. Option A is incorrect because adding a bucket policy does not address network timeouts. Option B (S3 VPC endpoint) improves network reliability but does not directly resolve idle timeout mismatches. Option D (S3 Transfer Acceleration) is designed for large files over long distances and does not fix idle timeout issues.

Answer

Add a bucket policy that grants s3:PutObject to the application's IAM role.

Answer

Use an S3 VPC endpoint to improve network reliability.

Answer

Enable S3 Transfer Acceleration on the bucket and update the application to use the accelerated endpoint.

Question 12

A developer is troubleshooting a Lambda function that occasionally times out. The function makes HTTPS calls to an external API. Which configuration change is MOST likely to resolve the issue without increasing the risk of further timeouts?

Accepted Answer

Increase the function's timeout setting.. Increasing the function's timeout setting allows more time for the Lambda function to wait for the external HTTPS API response, reducing the chance of timeout errors. Option A is wrong because increasing memory/CPU does not help if the API itself is slow to respond. Option B is wrong because decreasing reserved concurrency limits the number of concurrent executions but does not address a single function's timeout. Option D is wrong because changing invocation type to synchronous does not affect the function's timeout configuration.

Answer

Increase the function's memory allocation.

Answer

Decrease the function's reserved concurrency.

Answer

Change the function invocation type to synchronous.

Question 13

A developer is using Amazon API Gateway with a Lambda authorizer to protect a REST API. The authorizer is configured with a TTL of 300 seconds. After updating the IAM policy attached to the authorizer's execution role, some users still receive 403 Forbidden errors for requests that should be allowed. What is the MOST likely cause?

Accepted Answer

The authorizer's cached results are still valid, so the old policy is being applied.. The Lambda authorizer caches results for the configured TTL of 300 seconds. Since the cache hasn't expired, the old policy is still applied, resulting in 403 errors for requests that should be allowed. Option A is incorrect because the Lambda function timeout does not affect caching of prior decisions. Option C is incorrect because IAM policy updates are global and propagate quickly; the issue is caching. Option D is incorrect because redeploying the API does not clear the authorizer cache.

Answer

The Lambda authorizer function has a timeout that prevents it from evaluating the new policy.

Answer

The IAM policy update has not propagated to all regions.

Answer

The API Gateway endpoint was not redeployed after the policy change.

Question 14

A developer notices that an S3 bucket configured for static website hosting returns 403 Forbidden errors when accessed from a browser. The bucket policy allows s3:GetObject for principal "*" but only over HTTPS. What is the MOST likely reason for the error?

Accepted Answer

The request was sent over HTTP instead of HTTPS.. The bucket policy includes a condition that requires HTTPS. If the browser sends an HTTP request, the condition fails and the request is denied with a 403 error. Option A is incorrect because the policy allows anonymous access (principal "*") and does not require IAM authentication. Option B is incorrect because the policy explicitly allows s3:GetObject for anonymous principals over HTTPS. Option D is incorrect because the S3 website endpoint does support HTTPS; the issue is the condition in the policy, not the endpoint's protocol support.

Answer

The requester is not authenticated with AWS IAM.

Answer

The bucket policy denies s3:GetObject for anonymous principals.

Answer

The S3 bucket website endpoint does not support HTTPS.

Question 15

A developer is running a Docker container on Amazon ECS with Fargate. The container logs are not appearing in CloudWatch Logs even though the task definition has a logConfiguration specifying the awslogs driver and a log group. What is the MOST likely missing configuration?

Accepted Answer

The task execution role lacks the necessary IAM permissions to write to CloudWatch Logs.. The task execution role must have permissions to write to CloudWatch Logs. Option A is wrong because the awslogs log driver is included in the ECS-optimized AMI and does not need to be installed separately; it is configured in the task definition. Option C is wrong because the log group does not need to exist beforehand; CloudWatch Logs can auto-create it if the task execution role has proper permissions. Option D is wrong because Fargate does not use EC2 instance profiles; the task execution role is used instead.

Answer

The container image does not have the awslogs log driver installed.

Answer

The CloudWatch Logs log group does not exist.

Answer

The EC2 instance profile does not have CloudWatch Logs permissions.