DVA-C02 Troubleshooting and Optimization Practice Test 12 — 15 Questions

Question 1

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB health checks are failing for a few instances, but the instances themselves are running and have healthy application processes. What is the MOST likely cause?

Accepted Answer

The security group for the EC2 instances is not allowing traffic from the ALB.. The ALB health checks are failing despite the instances and application processes being healthy, which indicates a network-level issue. The most likely cause is that the EC2 instances' security group is not allowing inbound traffic from the ALB's security group on the health check port (e.g., HTTP/HTTPS). Without this rule, the ALB cannot reach the health check endpoint, marking the instances as unhealthy and causing intermittent 503 errors when traffic is routed to those instances.

Answer

The ALB is not scaled to handle the traffic.

Answer

The DNS resolution via Route53 is misconfigured.

Answer

Sticky sessions are not enabled on the ALB.

Question 2

A developer is troubleshooting an AWS Lambda function that writes to an S3 bucket. The function is failing with an 'AccessDenied' error. The Lambda execution role has the following policy. What is the likely issue?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Accepted Answer

The bucket uses SSE-KMS encryption, and the role lacks kms:Decrypt permission.. Option A is correct because the policy only grants access to objects in the bucket, not to the bucket itself for operations like ListBucket, but for PutObject, the resource is correct. However, the error may be due to a missing permission for s3:PutObject on the bucket level if the bucket policy also requires it. Actually, the most common issue for PutObject is the resource ARN, which is correct. But if the bucket is encrypted, you need kms:Decrypt permissions. Option A points to missing KMS permissions, which is plausible. Option B is wrong because the resource is correct. Option C is wrong because S3 does not require s3:ListBucket for PutObject. Option D is wrong because the action is allowed.

Answer

The resource ARN should be 'arn:aws:s3:::my-bucket' instead of 'my-bucket/*'.

Answer

The action should be 's3:PutObject' only, not 's3:GetObject'.

Answer

The role is missing s3:ListBucket permission.

Question 3

A developer is optimizing a Node.js Lambda function that processes CSV files from S3. The function reads the entire file into memory, processes it, and writes results to DynamoDB. For large files, the function runs out of memory. What is the MOST effective optimization?

Accepted Answer

Use the AWS SDK's S3 GetObject with a stream and process in chunks.. Option D is correct because streaming the file from S3 avoids loading the entire file into memory. Option A is wrong because increasing Lambda timeout does not address memory. Option B is wrong because increasing memory may help but is less efficient than streaming. Option C is wrong because S3 Select is for filtering, not streaming.

Answer

Increase the Lambda timeout to allow more processing time.

Answer

Increase the Lambda function memory to 3008 MB.

Answer

Use S3 Select to retrieve only necessary columns.

Question 4

A company uses AWS CloudFormation to deploy a stack that includes an RDS MySQL instance. During an update, the stack fails with a 'DELETE_FAILED' status on a security group resource. The security group has a dependency on the RDS instance. What is the MOST likely cause?

Accepted Answer

The RDS instance is not fully deleted because of a deletion protection flag.. Option C is correct because the RDS instance is in a 'deleting' state and the security group cannot be deleted until the RDS instance is fully deleted. Option A is wrong because the security group is not the issue. Option B is wrong because CloudFormation does not require manual deletion. Option D is wrong because the issue is not about the security group being in use by other resources.

Answer

The security group has a rule that references itself.

Answer

The security group must be deleted manually before updating the stack.

Answer

The security group is attached to an EC2 instance outside the stack.

Question 5

A developer notices that an S3 bucket policy allows public read access to all objects. The bucket contains sensitive data that should only be accessible by authorized IAM users. What is the BEST way to remediate this?

Accepted Answer

Modify the bucket policy to remove the public statement and use IAM policies for access.. Option B is correct because the bucket policy currently grants public read access, which overrides any IAM-based restrictions. By removing the public statement from the bucket policy and relying solely on IAM policies, access is controlled at the user level, ensuring only authorized IAM users can read objects. This aligns with the principle of least privilege and follows AWS best practices for securing S3 data.

Answer

Enable default encryption on the bucket.

Answer

Enable S3 Block Public Access at the account level.

Answer

Enable S3 Object Ownership and use ACLs.

Question 6

A developer is troubleshooting a slow-running Amazon RDS for PostgreSQL instance. Which TWO metrics should the developer examine in Amazon CloudWatch to identify a possible resource bottleneck?

Accepted Answer

CPUUtilization. Option A is correct because high CPU utilization can cause slow queries. Option C is correct because high Read/Write IOPS with high latency indicates an I/O bottleneck. Option B is wrong because Freeable Memory is less directly indicative of a bottleneck. Option D is wrong because DatabaseConnections does not directly indicate a bottleneck unless maxed out. Option E is wrong because NetworkThroughput is rarely a bottleneck for RDS.

Answer

FreeableMemory

Answer

NetworkThroughput

Answer

DatabaseConnections

Question 7

A company is using Amazon S3 to store log files. The logs are rarely accessed after 30 days but must be retained for 7 years for compliance. Which THREE actions should the company take to optimize storage costs?

Accepted Answer

Use S3 Lifecycle policy to transition objects to S3 Glacier after 1 year.. Option A is correct because transitioning to S3 Standard-IA after 30 days reduces cost for infrequent access. Option B is correct because transitioning to S3 Glacier after 1 year reduces cost for long-term retention. Option D is correct because lifecycle policies automate transitions. Option C is wrong because S3 One Zone-IA is not durable enough for compliance. Option E is wrong because deleting after 30 days violates retention requirement.

Answer

Use S3 Lifecycle policy to delete objects after 30 days.

Answer

Store objects in S3 One Zone-IA from the start.

Question 8

A developer is debugging an AWS Lambda function that is invoked by an Amazon S3 event notification. The function sometimes fails with a 'ResourceNotFoundException' when trying to access a DynamoDB table. The function's execution role has the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "dynamodb:*",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"
    }
  ]
}

What are TWO possible causes for this intermittent failure?

Accepted Answer

The DynamoDB table name contains a typo in the Lambda code.. Option B is correct because if the table is in a different region, the resource ARN region would be wrong. Option D is correct because if the table name is different, the ARN would not match. Option A is wrong because the policy allows all DynamoDB actions. Option C is wrong because the function has the policy. Option E is wrong because VPC endpoints do not affect IAM permissions.

Answer

The Lambda function's execution role is not attached to the function.

Answer

The Lambda function is inside a VPC without a DynamoDB VPC endpoint.

Answer

The IAM policy does not include the 'dynamodb:GetItem' action specifically.

Question 9

A developer is using Amazon ElastiCache to improve the performance of a read-heavy web application. After implementing caching, some users see stale data. Which TWO strategies can the developer use to ensure cache coherence?

Accepted Answer

Set a suitable TTL for cached data.. Option A is correct because setting a suitable Time-To-Live (TTL) on cached data ensures that stale entries are automatically evicted after a defined period. This forces the application to fetch fresh data from the primary database when the TTL expires, thereby maintaining cache coherence without requiring immediate invalidation on every write. In ElastiCache (Redis or Memcached), TTL is set per key using commands like EXPIRE or SETEX, and it is a simple, effective strategy for read-heavy workloads where eventual consistency is acceptable.

Answer

Use write-through caching.

Answer

Use read replicas of the database to serve read traffic.

Answer

Implement lazy loading with a short TTL.

Question 10

A company runs a production web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application uses a custom health check endpoint /health that returns HTTP 200 when the application is healthy. Recently, the operations team noticed that the Auto Scaling group is repeatedly launching and terminating instances (flapping) even though the application is stable. The health check grace period is set to 300 seconds. The ALB health check interval is 30 seconds, unhealthy threshold is 2, and healthy threshold is 5. The Auto Scaling group uses the ELB health check type. The application logs show no errors. What is the MOST likely cause of the flapping?

Accepted Answer

The healthy threshold is set too high, causing instances to be considered unhealthy for too long.. Option D is correct. The healthy threshold is 5, meaning an instance must pass 5 consecutive health checks to be considered healthy. With a 30-second interval, it takes 2.5 minutes to become healthy, but the health check grace period is 300 seconds (5 minutes). However, if the instance initially fails health checks because the application takes longer than 30 seconds to start, it will be marked unhealthy. More importantly, the healthy threshold of 5 is high, so after the grace period, the instance may still be considered unhealthy if it has not passed 5 checks. The combination of high healthy threshold and low unhealthy threshold can cause flapping. Option A is wrong because the ALB is not failing. Option B is wrong because scaling policies are not mentioned. Option C is wrong because the instance type is unlikely to cause this.

Answer

The EC2 instance type is not suitable for the application, causing slow responses.

Answer

The ALB is experiencing high latency and marking instances unhealthy.

Answer

The Auto Scaling group has a target tracking scaling policy that is too aggressive.

Question 11

A developer receives an AccessDenied error when trying to put an object into an S3 bucket using the AWS SDK. The IAM user has an attached policy that grants s3:PutObject on the bucket. What is the MOST likely cause of the error?

Accepted Answer

The bucket policy explicitly denies the action.. Option B is correct because S3 buckets often have a bucket policy that explicitly denies access, which would override the IAM user's permissions. Option A is wrong because S3 does not support resource-based policies at the object level. Option C is wrong because the error is AccessDenied, not a timeout or throttling. Option D is wrong because the issue is at the API call level, not the SDK version.

Answer

The request is being throttled by S3.

Answer

The object key is too long.

Answer

The AWS SDK version is outdated.

Question 12

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The EC2 instances are in an Auto Scaling group. What is the MOST likely cause?

Accepted Answer

The target group health checks are failing.. Option C is correct because an unhealthy target is the most common cause of 503 errors with ALB. Option A is wrong because DNS resolution happens at the client side, not at the ALB. Option B is wrong because SSL certificate issues cause 502 errors. Option D is wrong because security group rules affect connectivity, not HTTP status codes.

Answer

The SSL certificate on the ALB has expired.

Answer

The ALB DNS name is not resolving.

Answer

The security group for the ALB is blocking traffic.

Question 13

A developer is using AWS Lambda with a VPC configuration. The function needs to access an Amazon RDS instance in the same VPC. The function is timing out after 3 seconds. What is the MOST likely cause?

Accepted Answer

The Lambda function's security group does not allow outbound traffic to the RDS instance.. Option C is correct because Lambda functions in a VPC need a NAT gateway or VPC endpoints to access the internet, but to access RDS in the same VPC, they need a route to the RDS subnet. However, the most common cause of timeout is missing a route to the RDS subnet via a VPC peering or transit gateway, but here the RDS is in the same VPC, so the issue is likely that the Lambda function's security group does not allow outbound traffic to the RDS security group. Option A is wrong because RDS proxy is not required. Option B is wrong because the function can access the database directly via its private IP. Option D is wrong because the function timeout is set to 3 seconds, which is the default; it could be increased, but the root cause is connectivity.

Answer

The Lambda function's execution role does not have rds:Connect permission.

Answer

The Lambda function does not have an RDS proxy configured.

Answer

The Lambda function timeout is set too low.

Question 14

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. Lately, the API is returning 502 Bad Gateway errors. What is the MOST likely cause?

Accepted Answer

The Lambda function is returning an unhandled exception.. Option B is correct because 502 errors in API Gateway with Lambda integration typically indicate that the Lambda function returned an error. Option A is wrong because throttling would cause 429 Too Many Requests. Option C is wrong because IAM permissions would cause 403 Forbidden. Option D is wrong because API keys are used for client authentication, not for backend integration.

Answer

The API Gateway request throttling limit has been exceeded.

Answer

The API Gateway API key is invalid.

Answer

The Lambda function's execution role does not allow API Gateway to invoke it.

Question 15

A developer is using Amazon DynamoDB with provisioned throughput. The application is receiving ProvisionedThroughputExceededException errors. What is the BEST way to handle this error?

Accepted Answer

Implement exponential backoff and retry in the application code.. Option D is correct because the best practice is to implement exponential backoff and retry logic. Option A is wrong because the error is transient, not a permanent issue. Option B is wrong because switching to on-demand would resolve the issue but is not the best way to handle the error; it's a capacity change, not an error handling strategy. Option C is wrong because reducing read capacity would make the problem worse.

Answer

Contact AWS Support to increase the DynamoDB service limits.

Answer

Reduce the read and write capacity units.

Answer

Switch the table to on-demand capacity mode.