DVA-C02 Troubleshooting and Optimization Practice Test 15 — 15 Questions

Question 1

A developer is using AWS X-Ray to trace requests through a microservices application. One of the services, Service B, is not appearing in the trace map. What is the MOST likely reason?

Accepted Answer

Service B is not instrumented with the X-Ray SDK.. For X-Ray to trace requests across services, each service must be instrumented with the X-Ray SDK. If Service B is not instrumented, it won't send trace data, and it won't appear in the trace map.

Answer

Service B is using HTTP/2, which is not supported by X-Ray.

Answer

Service B is running in a different AWS region.

Answer

The X-Ray sampling rate is set too low.

Question 2

Which TWO actions should a developer take to optimize cost and performance for a Lambda function that processes real-time streaming data from Amazon Kinesis? (Choose 2.)

Accepted Answer

Enable the parallelization factor to process multiple batches concurrently per shard.. Increasing batch size and enabling parallelization factor reduce the number of Lambda invocations and improve throughput. Provisioned concurrency is for latency, not cost/performance optimization for Kinesis. Increasing memory may be needed but not directly for cost optimization.

Answer

Enable provisioned concurrency to reduce cold starts.

Answer

Increase the Lambda function memory to improve processing speed.

Answer

Use a larger Kinesis shard count.

Question 3

A developer is troubleshooting an EC2 instance that is unreachable via SSH. The instance is in a public subnet with a security group that allows inbound SSH from 0.0.0.0/0. Which THREE are possible causes? (Choose 3.)

Accepted Answer

The network ACL associated with the subnet is blocking inbound SSH.. Network ACLs can block traffic even if security group allows. The instance may not have a public IP. The IAM role doesn't affect SSH access. The key pair is used for authentication, not connectivity. The instance may be stopped.

Answer

The SSH key pair used to launch the instance is incorrect.

Answer

The instance does not have an IAM role with the necessary permissions.

Question 4

Which TWO practices help optimize costs in Amazon DynamoDB? (Choose 2.)

Accepted Answer

Use Auto Scaling to adjust read/wapacity based on traffic.. Option B is correct because DynamoDB Auto Scaling automatically adjusts provisioned read and write capacity based on actual traffic patterns, preventing over-provisioning and reducing costs during low-demand periods. Option E is correct because on-demand capacity mode charges per request, making it cost-effective for unpredictable workloads where capacity planning is difficult, avoiding the cost of idle provisioned capacity.

Answer

Purchase reserved capacity for all tables regardless of usage.

Answer

Create multiple Global Secondary Indexes for query flexibility.

Answer

Enable DAX (DynamoDB Accelerator) for all tables.

Question 5

A developer attached the IAM policy above to an IAM role used by an EC2 instance. The instance is in a VPC with CIDR 10.0.0.0/16, but it cannot access objects in the S3 bucket 'example-bucket'. What is the MOST likely reason?

Accepted Answer

The condition should use 'aws:VpcSourceIp' instead of 'aws:SourceIp'.. The condition uses 'aws:SourceIp', but EC2 instances in a VPC have private IPs. For S3, the source IP that AWS sees is the public IP (if traffic goes through internet gateway) or the VPC endpoint's private IP. If the bucket policy uses 'aws:SourceIp', it compares against the source IP of the request, which for EC2 instances without a VPC endpoint is the instance's public IP (if any) or the NAT gateway's IP, not the private IP. The condition should use 'aws:VpcSourceIp' if using a VPC endpoint, or the policy should not rely on source IP from private ranges.

Answer

The policy does not allow 's3:ListBucket' action.

Answer

The IAM role does not have a trust policy.

Answer

The S3 bucket is in a different region than the EC2 instance.

Question 6

A developer notices that the Lambda function 'my-function' is not generating any logs in CloudWatch, although the function is invoked successfully. The developer runs the command above. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role is missing the 'logs:CreateLogStream' and 'logs:PutLogEvents' permissions.. The log group exists but has 0 stored bytes, meaning no log streams have been created. This typically indicates that the Lambda function's execution role does not have permissions to create log streams and put log events. The function runs but fails silently to write logs.

Answer

The log group retention policy is set to 0 days.

Answer

The Lambda function is configured to log to a custom log group.

Answer

The Lambda function has reserved concurrency set to 0.

Question 7

A developer tries to create a CloudFormation stack using the template above, but it fails with 'The bucket you tried to create already exists'. The developer has already deleted the bucket from the AWS Management Console. What is the MOST likely reason for the failure?

Accepted Answer

The bucket name is still globally reserved after deletion.. Even after deletion, the bucket name may still be in a 'pending deletion' state or may have been taken by another AWS account. S3 bucket names are globally unique. If the name is still reserved (e.g., recently deleted), you cannot recreate it immediately. The developer should use a different bucket name.

Answer

The CloudFormation template uses an incorrect intrinsic function.

Answer

Bucket versioning must be Disabled initially.

Answer

The developer does not have permission to create buckets in that region.

Question 8

A developer notices that an AWS Lambda function is timing out after 3 seconds. The function processes messages from an SQS queue. What is the MOST likely cause of the timeout?

Accepted Answer

The Lambda function timeout is set too low.. The function's timeout setting is likely lower than the time needed for processing. Option A is correct because the default Lambda timeout is 3 seconds, and increasing it can resolve the issue. Option B is wrong because SQS visibility timeout controls message redelivery, not function timeout. Option C is wrong because reserved concurrency affects scaling, not individual function timeout. Option D is wrong because the DLQ is for failed messages, not timeout control.

Answer

The SQS dead-letter queue is not configured.

Answer

The SQS queue visibility timeout is too short.

Answer

The Lambda function's reserved concurrency is set to zero.

Question 9

A company runs a Node.js application on Amazon EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB target group health checks are failing. The developer checks the EC2 instance logs and sees no application errors. What is the MOST likely cause?

Accepted Answer

The health check path returns a 5xx status code due to a missing dependency.. Option D is correct because if health checks are failing but the application works, the health check path or configuration is likely wrong. Option A is wrong because security group rules blocking health checks would cause constant failure. Option B is wrong because the application is responding on the correct port. Option C is wrong because health checks target a specific path, not the root.

Answer

The health check path is set to '/' but the application serves on a different path.

Answer

The EC2 instances are running out of memory.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB.

Question 10

A developer is troubleshooting a slow Amazon RDS MySQL database query. The query is frequently executed and takes 5 seconds to complete. Which AWS service should the developer use to analyze the query performance?

Accepted Answer

Amazon RDS Performance Insights. Option A is correct because RDS Performance Insights provides database performance analysis with query-level metrics. Option B is wrong because CloudWatch Logs is for log data, not query analysis. Option C is wrong because X-Ray is for distributed tracing, not database queries. Option D is wrong because CloudTrail is for API activity, not database performance.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Question 11

A developer deployed a new version of an AWS Lambda function using the AWS CLI update-function-code command. The function uses environment variables to store database credentials. After the update, the function returns errors indicating it cannot connect to the database. What is the MOST likely cause?

Accepted Answer

The environment variables were not set in the new version.. Option B is correct because update-function-code does not preserve environment variables; they are reset. Option A is wrong because the function code is updated, not the IAM role. Option C is wrong because environment variables are not encrypted by default but that wouldn't cause connection failure. Option D is wrong because the function ARN doesn't affect environment variables.

Answer

The function ARN changed after the update.

Answer

The database credentials are encrypted but the function cannot decrypt them.

Answer

The function's IAM role was changed during the update.

Question 12

A company uses Amazon API Gateway with a Lambda integration. The API returns a 502 Bad Gateway error for some requests. The Lambda function writes logs to CloudWatch. Which steps should a developer take to troubleshoot this issue? (Select the BEST combination.)

Accepted Answer

Increase the Lambda function timeout and review the CloudWatch logs for errors.. Option C is correct because increasing Lambda timeout and checking CloudWatch logs can identify if the function is timing out or has an error. Option A is wrong because API Gateway throttling returns 429, not 502. Option B is wrong because IAM permissions would cause 403. Option D is wrong because enabling detailed metrics helps but doesn't directly troubleshoot 502.

Answer

Enable API Gateway detailed metrics and create a dashboard.

Answer

Verify the IAM role permissions for API Gateway to invoke Lambda.

Answer

Check the API Gateway throttling settings and request limit.

Question 13

A developer is deploying a new version of an application to Amazon ECS using the Fargate launch type. The task fails to start and the error message indicates that the task cannot pull the container image from Amazon ECR. What is the MOST likely cause?

Accepted Answer

The task execution role lacks permissions to pull from ECR.. Option A is correct because the task execution role needs ecr:GetDownloadUrlForLayer and ecr:BatchGetImage permissions. Option B is wrong because Fargate does not use a host port mapping. Option C is wrong because CPU/memory limits would cause task failure, not image pull error. Option D is wrong because task definition family is not related to image pull.

Answer

The task definition family name is incorrect.

Answer

The container port is not mapped to a host port.

Answer

The CPU or memory limits are too low for the container.

Question 14

A developer configured an S3 bucket to trigger a Lambda function on object creation. The Lambda function processes the object and then deletes it. Some objects are not being processed. What should the developer do to ensure all objects are processed?

Accepted Answer

Send S3 events to an SQS queue and configure the Lambda function to poll the queue.. Option C is correct because sending S3 events to an SQS queue decouples event delivery from Lambda invocation. If the Lambda function fails or throttles, the event remains in the queue and can be retried, ensuring no objects are missed. Without a queue, S3 events that fail to invoke Lambda (e.g., due to concurrency limits) are lost, leading to unprocessed objects.

Answer

Assign a new IAM role to the Lambda function with S3 permissions.

Answer

Enable S3 versioning on the bucket.

Answer

Increase the Lambda function timeout.

Question 15

A company is using Amazon DynamoDB with on-demand capacity. A developer notices that write requests are being throttled during peak hours. What is the MOST effective way to resolve this issue?

Accepted Answer

Review the partition key design and consider adding a suffix to distribute writes.. Option D is correct because on-demand capacity can still throttle if you exceed the previous peak traffic by a large margin; the table can be split into multiple partitions to distribute write load. Option A is wrong because on-demand already auto-scales. Option B is wrong because increasing read capacity does not help writes. Option C is wrong because there are no WCU limits in on-demand mode.

Answer

Switch to provisioned capacity mode with auto-scaling.

Answer

Increase the write capacity units.

Answer

Increase the read capacity units.