DVA-C02 Troubleshooting and Optimization Practice Test 13 — 15 Questions

Question 1

A developer is troubleshooting an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function processes new objects and writes results to a DynamoDB table. Recently, some objects are not being processed. The developer checks the CloudWatch Logs for the Lambda function and sees no errors. Which TWO actions should the developer take to investigate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the S3 bucket notification configuration to ensure it is properly set for the correct events.. Checking the S3 bucket notification configuration ensures that the events are properly set for the correct object creation events, so the Lambda function is invoked for all new objects. Option D is correct: Configuring a dead-letter queue (DLQ) on the Lambda function captures events that failed to be processed or were not delivered due to errors, allowing investigation of unprocessed events. Option A is incorrect because DynamoDB Streams are not relevant to the invocation failure. Option B is incorrect because increasing memory would not help if the function is not being invoked. Option E is incorrect because CloudWatch Logs already show no errors; the issue is likely before invocation, and timeout messages would appear in logs only if the function was invoked.

Answer

Enable DynamoDB Streams on the table and process records.

Answer

Increase the Lambda function's memory allocation.

Answer

Review the Lambda function's CloudWatch Logs for timeout messages.

Question 2

An application running on Amazon ECS with Fargate is experiencing intermittent failures when connecting to an Amazon RDS database. The security group for the RDS instance allows inbound traffic from the security group attached to the ECS tasks. Which TWO additional checks should the developer perform to troubleshoot the connectivity issue?

Accepted Answer

Verify that the security group for the RDS instance has an inbound rule allowing traffic from the security group used by the ECS tasks.. Options C and D are correct. Option C is necessary because the security group for the RDS instance must have an inbound rule that references the security group attached to the ECS tasks; verifying this rule ensures that the security group configuration is correct. Option D is important because network ACLs (NACLs) are stateless and can block traffic even if security groups allow it; checking that NACLs allow inbound and outbound traffic on ephemeral ports is critical for the response traffic. Option A (VPC Flow Logs) is useful for analyzing traffic patterns but is not a primary check for intermittent connectivity; it would be used after verifying basic configurations. Option B (database credentials) is unrelated to network connectivity. Option E is incorrect because ECS tasks using Fargate in a private subnet do not require an Internet Gateway to communicate with RDS within the same VPC.

Answer

Enable VPC Flow Logs to capture dropped packets.

Answer

Check that the database credentials are correctly stored in AWS Secrets Manager.

Answer

Ensure that the ECS tasks have a route to the internet through an Internet Gateway.

Question 3

A developer attached the IAM policy above to an IAM user. The user reports that they receive an AccessDenied error when trying to upload a file to the S3 bucket using the AWS CLI without specifying any server-side encryption. What is the reason for the error?

Accepted Answer

The request does not include the required server-side encryption header.. The policy requires s3:x-amz-server-side-encryption to be AES256. If not specified, the condition fails and the request is denied. Option A is wrong because the resource is correct. Option C is wrong because the action is allowed. Option D is wrong because putting an object without encryption does not match the condition.

Answer

The policy does not allow the s3:PutObject action on the bucket itself.

Answer

The IAM user does not have permissions to use the s3:PutObject action.

Answer

The bucket policy overrides the IAM policy.

Question 4

A developer runs the AWS CLI command above to view the latest log stream for a Lambda function. The output shows a log stream with lastEventTimestamp of 1710493200000 (approximately 1 hour ago). However, the function was invoked 5 minutes ago and did not produce any errors. What is the MOST likely explanation?

Accepted Answer

The command returned only the oldest log stream because of the limit and ordering parameters.. The command only returns one log stream due to the limit 1 parameter. There may be newer log streams that are not shown. Option A is wrong because the function did not fail. Option B is wrong because the log stream exists. Option C is wrong because the function was invoked recently.

Answer

The Lambda function was not actually invoked 5 minutes ago.

Answer

The Lambda function execution role lacks permissions to write to CloudWatch Logs.

Answer

The log stream was deleted after the last invocation.

Question 5

A company deploys a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application allows users to retrieve data by calling a REST API. Recently, users have reported that some requests return HTTP 500 errors. The developer investigates and finds that the Lambda function logs show occasional 'ProvisionedThroughputExceededException' errors when writing to a DynamoDB table. The table has provisioned read capacity of 5 and write capacity of 5. The Lambda function is configured with a reserved concurrency of 10. The developer wants to minimize errors without significantly increasing costs. Which action should the developer take?

Accepted Answer

Enable auto scaling for the DynamoDB table with a minimum write capacity of 5 and a maximum of 10.. Enabling DynamoDB auto scaling allows the table to handle bursts beyond provisioned capacity, reducing throttling while controlling cost. Option B is wrong because increasing reserved concurrency would cause more Lambda invocations and more writes, potentially worsening the throttling. Option C is wrong because adding retries with exponential backoff in the Lambda function may help, but it does not address the root cause of insufficient write capacity; it only reduces the immediate error rate but could increase latency and costs due to retries. Option D is wrong because using DAX is for read-heavy workloads and does not help with write capacity.

Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.

Answer

Increase the reserved concurrency for the Lambda function to 20.

Answer

Implement retry logic with exponential backoff in the Lambda function for DynamoDB write operations.

Question 6

A developer is managing an application that runs on an Amazon EC2 instance. The application uses an IAM role attached to the instance to access an S3 bucket. The developer recently updated the IAM role to add a new policy that grants access to a different S3 bucket. However, when testing, the application cannot access the new bucket and still returns 'Access Denied'. The developer verifies that the instance profile is correctly associated with the EC2 instance and that the new policy is attached. The application was restarted after the policy change. What is the MOST likely cause of the issue?

Accepted Answer

The temporary security credentials cached by the instance are still valid and do not reflect the new policy.. Temporary security credentials obtained from the instance metadata service are cached by the AWS SDK/CLI and do not automatically update when the IAM role policy changes. These credentials remain valid for their duration (default 6 hours) and continue to grant permissions based on the old policy. Restarting the application does not refresh the credentials; only when the credentials expire will new ones be obtained that include the updated policy. Option A is incorrect because the question states the new policy is attached and there is no indication of a bucket policy. Option C is incorrect because restarting the application multiple times does not refresh the cached credentials. Option D is incorrect because the instance profile was verified to be correctly associated.

Answer

The S3 bucket has a bucket policy that denies access to the IAM role.

Answer

The application needs to be restarted multiple times to pick up the new policy.

Answer

The instance profile is not correctly attached to the EC2 instance.

Question 7

A developer deployed a web application using AWS Elastic Beanstalk. The application uses an RDS MySQL database. After a recent deployment, the application's health status turned from 'Ok' to 'Severe'. The developer checks the environment events and sees that the database connection is failing. The RDS instance is in the same VPC and security group. The developer confirms that the database endpoint and credentials are correct. What is the MOST likely cause of the connection failure?

Accepted Answer

The security group for the Elastic Beanstalk environment no longer allows outbound traffic to the RDS database port.. Most likely correct because after a deployment, Elastic Beanstalk may update the security group rules for the environment. If the rule allowing outbound traffic to the RDS database port is missing, the application cannot connect. Option B is unlikely because the endpoint is confirmed as correct. Option C is irrelevant since the RDS instance is in the same VPC and security group, so public accessibility is not required. Option D is about the application starting, but the events show database connection failure, not a startup bug.

Answer

The RDS database endpoint changed after the deployment.

Answer

The RDS instance is not publicly accessible.

Answer

The application code is failing to start due to a bug.

Question 8

A company runs a critical application on Amazon ECS with Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. Recently, the company noticed that the ALB returns 502 Bad Gateway errors during peak traffic hours. The developer checks the ECS service metrics and sees that the number of running tasks remains constant, while CPU and memory utilization are below 50%. The ALB target group health checks are failing intermittently for some tasks. What is the MOST likely cause of the 502 errors?

Accepted Answer

The ALB idle timeout is set too low, causing connections to be closed before the application responds.. The ALB idle timeout determines how long the load balancer waits for a response from the target before closing the connection. If the application takes longer to respond than the timeout setting, the ALB terminates the connection and returns a 502 Bad Gateway error. The intermittent health check failures occur because some tasks may respond within the timeout while others do not, especially during peak traffic when processing times increase. Option A is incorrect because if the startup command were failing, tasks would never become healthy and health checks would consistently fail. Option B is incorrect because CPU and memory utilization below 50% indicate the tasks have spare capacity, so auto scaling would not resolve the latency issue. Option D is incorrect because if the security group were blocking traffic, health checks would consistently fail, not intermittently.

Answer

The task definition's startup command is failing, causing the tasks to never become healthy.

Answer

The ECS service is not configured with auto scaling to handle the increased traffic.

Answer

The security group for the ECS tasks is blocking traffic from the ALB.

Question 9

A developer is using Amazon CloudFront to distribute content from an S3 bucket. The bucket is configured as an origin with Origin Access Control (OAC). Recently, some users have reported that they receive 403 Forbidden errors when accessing certain objects. The developer checks the CloudFront distribution and confirms that the OAC is set up correctly. The S3 bucket policy allows the CloudFront service principal to get objects. The developer also notes that the objects in question have been updated recently. What is the MOST likely cause of the 403 errors?

Accepted Answer

The objects are encrypted with SSE-C (server-side encryption with customer-provided keys).. The most likely cause is that the objects are encrypted with SSE-C. CloudFront cannot serve objects encrypted with SSE-C because it does not have the encryption key. When CloudFront requests such objects from S3, S3 returns a 403 Forbidden error. The other options are incorrect: Option B is wrong because the OAC is correctly configured; Option C is wrong because the bucket policy allows the CloudFront service principal; Option D is wrong because using the S3 website endpoint would not cause a 403 for encrypted objects—it would cause a different error or redirect.

Answer

The OAC configuration is not correctly associated with the CloudFront distribution.

Answer

The S3 bucket policy denies access to the CloudFront service principal.

Answer

The CloudFront distribution is configured to use the S3 website endpoint instead of the REST endpoint.

Question 10

A company runs a serverless application on AWS using API Gateway, AWS Lambda, and DynamoDB. The application processes user uploads and stores metadata in DynamoDB. Recently, users have reported that some uploads fail with a 500 Internal Server Error. The CloudWatch Logs for the Lambda function show 'ProvisionedThroughputExceededException' errors for DynamoDB, followed by 'Task timed out after 3.00 seconds' errors. The Lambda function has a 3-second timeout and 128 MB of memory. The DynamoDB table has 5 read capacity units and 5 write capacity units. The application uses a single Lambda function that processes each upload synchronously. The company expects a steady increase in uploads. Which combination of actions should a developer take to resolve the errors and prepare for future growth? (Choose TWO.)

Accepted Answer

Increase the DynamoDB table's write capacity units to a higher value.. The errors are caused by DynamoDB throttling due to insufficient write capacity. Option A increases write capacity to handle the load. Option C implements retries with exponential backoff to handle occasional throttling without failing. Option B would not help because the errors are from DynamoDB, not Lambda concurrency. Option D would increase latency but not solve throttling. Option E might cause duplicate processing.

Answer

Switch the Lambda function to asynchronous invocation with a DLQ.

Answer

Increase the Lambda function's timeout to 30 seconds.

Answer

Increase the Lambda function's reserved concurrency to 100.

Question 11

A developer deployed a new version of an AWS Lambda function that is part of a serverless application. The function uses an Amazon DynamoDB table as a data store. After deployment, the developer notices that the function's latency has increased significantly for some requests. CloudWatch traces show that the increase is due to DynamoDB throttle events. The function is configured with a reserved concurrency of 100 and the DynamoDB table has 5 read capacity units (RCUs) and 5 write capacity units (WCUs). What is the most effective way to reduce the throttling while maintaining application performance?

Accepted Answer

Increase the read and write capacity units on the DynamoDB table. The primary cause of the throttling is insufficient DynamoDB capacity to handle the request volume from the Lambda function. Increasing the read and write capacity units (RCUs/WCUs) directly addresses the throttle events by providing more throughput to match the function's concurrency of 100. This is the most effective solution because it resolves the bottleneck at the data store level without reducing the application's ability to process requests concurrently.

Answer

Decrease the reserved concurrency of the Lambda function to 10

Answer

Enable DynamoDB Accelerator (DAX) for caching reads

Answer

Enable auto scaling on the DynamoDB table

Question 12

A developer is running an AWS Lambda function that is triggered by Amazon S3 events. The function writes processed data to an Amazon DynamoDB table. Over time, the function's execution time has increased significantly. CloudWatch Logs show many DynamoDBProvisionedThroughputExceededException errors. The table is configured with 5 read capacity units (RCUs) and 5 write capacity units (WCUs). The function performs both reads and writes. Which optimization will MOST effectively reduce throttling errors while maintaining performance?

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode. The DynamoDBProvisionedThroughputExceededException errors indicate that the Lambda function is exceeding the provisioned write capacity of 5 WCUs. Switching to on-demand capacity mode eliminates the need to manage throughput, automatically scaling to handle the workload without throttling. This directly resolves the root cause—capacity exhaustion—without requiring manual adjustments or architectural changes.

Answer

Increase the RCUs and WCUs of the table to 50 each

Answer

Implement a DynamoDB Accelerator (DAX) cluster for caching reads

Answer

Increase Lambda function memory to 1024 MB

Question 13

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During peak hours, users report receiving HTTP 503 (Service Unavailable) errors. The developer checks Amazon CloudWatch metrics and finds that the ALB's request count is high but below the limit, and the target group's healthy host count drops to zero intermittently. The Auto Scaling group for the instances is configured with a minimum of 2, maximum of 10, and a simple scaling policy to add 2 instances when CPU utilization exceeds 70% for 5 consecutive minutes. What is the most likely cause of the 503 errors?

Accepted Answer

The Auto Scaling group's cooldown period prevents new instances from being added quickly enough during rapid traffic spikes. The 503 errors occur because the simple scaling policy has a cooldown period (default 300 seconds) that prevents the Auto Scaling group from launching new instances during rapid traffic spikes. When CPU exceeds 70% for 5 minutes, the policy adds 2 instances, but the cooldown blocks further scaling actions until it expires, even if the newly launched instances are still initializing and the healthy host count drops to zero. This mismatch between traffic demand and scaling responsiveness causes the ALB to have no healthy targets, resulting in 503 errors.

Answer

The ALB's idle timeout is set too low, causing dropped connections

Answer

The Auto Scaling group's maximum capacity of 10 is insufficient

Answer

The health check grace period is preventing instances from being marked healthy

Question 14

A developer is troubleshooting an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function processes new objects and writes results to a DynamoDB table. Recently, some objects are not being processed. The developer checks the CloudWatch Logs for the Lambda function and sees no errors. Which TWO actions should the developer take to investigate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the memory allocation of the Lambda function to the maximum available (10,240 MB). Increasing the memory allocation to the maximum (10,240 MB) proportionally increases the CPU and network throughput allocated to the Lambda function, which directly reduces execution time for CPU-bound pandas operations. Since memory utilization is only at 80% of the current 3,008 MB, the bottleneck is likely CPU, not memory, and Lambda's CPU scales linearly with memory configuration. This action resolves the timeout without any code changes.

Answer

Increase the function timeout to the maximum allowed (900 seconds is already the max)

Answer

Use S3 Select to filter columns and rows before invoking the Lambda function

Answer

Increase the batch size of the S3 event notification to invoke the function with multiple files

Question 15

A developer is troubleshooting an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function processes new objects and writes results to a DynamoDB table. Recently, some objects are not being processed. The developer checks the CloudWatch Logs for the Lambda function and sees no errors. Which TWO actions should the developer take to investigate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

S3 event notifications are delivered at least once, and the Lambda function is not idempotent.. Amazon S3 event notifications are delivered on an 'at least once' basis, meaning the same event can be sent to Lambda multiple times. If the Lambda function is not idempotent—i.e., processing the same event multiple times produces duplicate side effects—then duplicate DynamoDB entries will occur. The use of a 'uuid' library inside the function does not help because a new UUID is generated on each invocation, so the same image gets different IDs and is stored as a separate item each time.

Answer

The Lambda function's concurrency is set too high, causing race conditions.

Answer

The DynamoDB table does not have a primary key that prevents duplicates.

Answer

The S3 bucket is configured with versioning, causing multiple object creation events.