DVA-C02 Troubleshooting and Optimization Practice Test 14 — 15 Questions

Question 1

A developer is using AWS X-Ray to trace a Lambda function that calls DynamoDB and SQS. Some traces show errors. Which TWO actions should the developer take to diagnose the issue?

Accepted Answer

Examine the trace details for exception messages.. To diagnose errors in existing X-Ray traces, the developer should examine trace details (Option A) to see exception messages and stack traces for each segment, and check the service map (Option C) for error edges that indicate which service interactions failed. Option B is about enabling X-Ray permissions, which is a prerequisite for tracing but does not help diagnose errors in traces that are already captured. Option D (disabling sampling) is unnecessary because X-Ray captures errors by default regardless of sampling. Option E (CloudFront caching) is unrelated to trace diagnostics.

Answer

Verify that the Lambda function's IAM role has permissions for X-Ray.

Answer

Disable X-Ray sampling to capture all requests.

Answer

Enable CloudFront to cache responses.

Question 2

Refer to the exhibit. A developer invoked a Lambda function and received this response. What does the FunctionError field indicate?

Accepted Answer

The function threw an unhandled exception.. FunctionError: Unhandled indicates that the function threw an exception that was not caught by the code. Option A is wrong because StatusCode 200 means invocation succeeded. Option C is wrong because throttling would return 429. Option D is wrong because configuration errors would return 400.

Answer

The function executed successfully.

Answer

The function was throttled.

Answer

The function timed out.

Question 3

Refer to the exhibit. A developer created this CloudFormation template. After deployment, the stack creation fails with 'Bucket name already exists'. What should the developer do to fix the issue?

Accepted Answer

Change the BucketName to include a random suffix.. The error 'Bucket name already exists' occurs because S3 bucket names are globally unique across all AWS accounts. The CloudFormation template hardcodes a BucketName that someone else already owns. The fix is to make the name unique, typically by appending a random suffix or using CloudFormation's auto-generated name (by omitting BucketName). This ensures the stack can create a new bucket without collision.

Answer

Remove the MyQueue resource.

Answer

Remove the VersioningConfiguration from the bucket.

Answer

Set SqsManagedSseEnabled to false.

Question 4

A developer is troubleshooting a slow-running Amazon RDS for MySQL query. The query performance has degraded over time. Which approach should the developer take first to identify the cause?

Accepted Answer

Enable Performance Insights and review the database load. Amazon RDS Performance Insights is the first-line diagnostic tool for identifying why a query has degraded — it visualizes database load (DBLoad) sliced by SQL statement, wait event, user, and host, showing exactly which query and which wait state is consuming resources. Enabling it is non-invasive and provides the evidence needed before making any infrastructure change. The other options are remediation steps that should only follow diagnosis.

Answer

Upgrade the DB instance to a larger instance class

Answer

Create a read replica to offload read traffic

Answer

Enable the MySQL query cache

Question 5

A developer is deploying a new version of a Lambda function and wants to roll back immediately if errors are detected. Which deployment strategy should the developer use?

Accepted Answer

Use AWS CodeDeploy with a canary deployment configuration. The correct option is A: AWS CodeDeploy with a canary deployment configuration. CodeDeploy supports Lambda deployments with traffic-shifting configurations, and a canary deployment shifts a small percentage of traffic first (e.g., 10% for 5 minutes) so that CloudWatch alarms can trigger an automatic rollback if errors are detected, satisfying the requirement to roll back immediately. Option B is wrong because EC2 rolling updates apply to EC2 instances, not Lambda functions. Option C is less suitable because a linear configuration shifts traffic in equal increments over time, which delays error detection compared to a canary's initial small traffic slice. Option D is wrong because immutable updates are an EC2/Elastic Beanstalk strategy, not a Lambda deployment strategy.

Answer

Use an EC2 rolling update strategy

Answer

Use AWS CodeDeploy with a linear deployment configuration

Answer

Use an immutable update strategy

Question 6

A development team is using AWS CodeCommit as a source repository and CodeBuild for build automation. They want to trigger a build automatically whenever a pull request is created or updated in the repository. Which configuration should they use?

Accepted Answer

Use Amazon EventBridge to capture CodeCommit events and trigger CodeBuild. The correct option is C: use Amazon EventBridge to capture CodeCommit events and trigger CodeBuild. CodeCommit emits pull request state-change events (e.g., pullRequestCreated and pullRequestSourceBranchUpdated) to the default EventBridge bus, and an EventBridge rule can match those events and invoke CodeBuild as a target, which is the supported way to start builds on pull request creation or updates. Option A is wrong because S3 event notifications apply to S3 buckets, not CodeCommit repositories. Option B is wrong because CodeCommit webhooks are not a native trigger mechanism for CodeBuild in this pull request scenario. Option D is wrong because CodePipeline polling detects branch commits, not pull request creation/update events, and polling is not event-driven.

Answer

Configure an S3 event notification on the repository

Answer

Configure a webhook in CodeCommit to trigger CodeBuild

Answer

Create a CodePipeline that polls CodeCommit for changes

Question 7

An application uses an Auto Scaling group with a launch configuration that includes a user data script to configure instances. After a scaling event, new instances launch but fail to register with the target group. The existing instances continue to work. What should the developer do to resolve this issue?

Accepted Answer

Create a new launch configuration with corrected user data and update the Auto Scaling group. Launch configurations are immutable — once created, they cannot be modified. To fix incorrect user data, the developer must create a new launch configuration with the corrected script and update the Auto Scaling group to reference it. Existing instances keep running with the old configuration, but new instances launched after the update will use the corrected user data and register successfully.

Answer

Modify the existing launch configuration with the correct user data

Answer

Update the Auto Scaling group to use the latest launch configuration version

Answer

Delete and recreate the Auto Scaling group

Question 8

A developer is troubleshooting an AWS Lambda function that is failing with an 'AccessDenied' error when trying to write to an S3 bucket. The function's execution role has the following policy. What is the most likely cause of the failure? (Policy: { 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Action': 's3:PutObject', 'Resource': 'arn:aws:s3:::my-bucket/*' } ] })

Accepted Answer

The S3 bucket has a bucket policy that denies the Lambda role access.. The IAM policy attached to the Lambda execution role correctly allows s3:PutObject on the bucket's objects. However, when a bucket policy explicitly denies access to the role or does not grant the required permissions, it takes precedence over the identity-based policy, resulting in an 'AccessDenied' error. Therefore, the most likely cause is a restrictive bucket policy.

Answer

The resource ARN does not include the bucket itself; it only includes objects

Answer

The action 's3:PutObject' is not allowed for Lambda execution roles

Answer

The action 's3:PutObject' is not sufficient; need 's3:*'

Question 9

A company runs a web application on EC2 instances in an Auto Scaling group. The application needs to store session state. The architecture must be highly available and scalable. Which solution should the developer choose?

Accepted Answer

Use Amazon ElastiCache for Redis to store session state. Amazon ElastiCache for Redis is a fully managed, highly available, and scalable in-memory data store that is purpose-built for session state management. It supports replication, automatic failover, and horizontal scaling, making it the ideal choice for a highly available and scalable session store across an Auto Scaling group of EC2 instances.

Answer

Use sticky sessions on the Application Load Balancer

Answer

Store session data in an S3 bucket

Answer

Store session data in the instance's ephemeral storage

Question 10

A developer is using AWS CodePipeline to automate a multi-stage pipeline. The pipeline includes a manual approval step before deploying to production. The developer wants to receive an email notification when the pipeline reaches the approval step. Which service should the developer use?

Accepted Answer

Use Amazon CloudWatch Events to detect the pipeline state change and trigger an SNS notification. CloudWatch Events (now part of Amazon EventBridge) can detect pipeline state changes such as a manual approval step entering a 'waiting' state. You can create a rule that matches this event and targets an Amazon SNS topic to send an email notification. Option A is incorrect because CodePipeline does not have an 'Email' action built-in. Option B is incorrect because CloudWatch Logs is used for monitoring log data, not for triggering notifications directly. Option C is incorrect because while Amazon SES can send emails, it is not directly integrated with CodePipeline; the recommended approach is to use CloudWatch Events with SNS for notifications.

Answer

Configure CodePipeline to send an email using the 'Email' action

Answer

Use Amazon CloudWatch Logs to monitor the pipeline logs and trigger an alarm

Answer

Use Amazon Simple Email Service (SES) to send an email from the pipeline

Question 11

Which TWO services can be used to store and retrieve application configuration data in AWS? (Choose 2)

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store (Option C) is a managed service specifically designed to store and retrieve application configuration data, such as database connection strings, passwords, and license keys. It integrates with AWS KMS for encryption and supports hierarchical parameter paths, making it ideal for configuration management without custom code.

Answer

AWS CloudTrail

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon DynamoDB

Question 12

Which THREE factors should a developer consider when designing a stateless application on AWS? (Choose 3)

Accepted Answer

Avoid storing data on the local file system of the instances. A stateless application should not store session state locally, so option A is correct. Session state should be stored in an external shared datastore like ElastiCache (option B) or a shared database like DynamoDB (option E). Storing state in instance memory (C) or using sticky sessions (D) would introduce statefulness, which is not desired in a stateless architecture.

Answer

Store session state in the instance memory for low latency

Answer

Use sticky sessions on the load balancer to maintain session affinity

Question 13

A developer ran the above CLI command to describe an EC2 instance. The instance is running but the developer cannot connect to it via SSH. Which additional step should the developer take to troubleshoot the connectivity issue?

Accepted Answer

Check the security group rules associated with the instance. Security group rules control inbound traffic to the instance. If the security group does not allow SSH (port 22) from the developer's IP, the connection will fail even if the instance is running and has a public IP. The describe-instances command output includes security group names and IDs, allowing the developer to verify the rules. Option A is wrong because a valid AMI does not guarantee network connectivity. Option B is wrong because the instance may have a public IP but still be unreachable if the security group blocks SSH. Option C is wrong because instance status checks indicate the OS and instance health, not network-level access.

Answer

Check the AMI ID to ensure it is a valid Linux AMI

Answer

Check the instance's network interfaces for a public IP

Answer

Check the instance status checks in the EC2 console

Question 14

A developer notices that an AWS Lambda function configured with a VPC is timing out when trying to access an Amazon S3 bucket. The function has the necessary IAM permissions. What is the most likely cause?

Accepted Answer

The Lambda function does not have a route to the internet or a VPC endpoint for S3.. When a Lambda function is attached to a VPC, it loses the default internet access it normally has and can only reach resources within that VPC's subnets. To reach S3, the function must either route through a NAT gateway/instance to the public internet or use an S3 Gateway VPC Endpoint, which provides private connectivity without traversing the internet.

Answer

Lambda functions cannot be configured inside a VPC.

Answer

The Lambda function's execution role lacks S3 permissions.

Answer

The security group attached to the Lambda function does not allow outbound traffic to S3.

Question 15

A developer is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The build fails with the error 'no basic authentication credentials'. The build project has an IAM role with the AmazonEC2ContainerRegistryPowerUser policy. What is the most likely cause?

Accepted Answer

The buildspec does not include the pre_build step to authenticate with ECR.. AWS CodeBuild does not automatically authenticate to Amazon ECR. The buildspec must include a pre_build phase that runs 'aws ecr get-login-password' piped to 'docker login' (or uses the ECR credential helper) to obtain temporary credentials. The IAM role's AmazonEC2ContainerRegistryPowerUser policy grants the necessary permissions, but the Docker client still needs explicit authentication before pushing.

Answer

The build project is not configured to use a VPC that can reach ECR.

Answer

The build environment does not have Docker installed.

Answer

The IAM role does not have sufficient permissions to push to ECR.