DVA-C02 Troubleshooting and Optimization Practice Test 17 — 15 Questions

Question 1

A developer is troubleshooting an AWS CloudFormation stack that failed to create. The error message says 'The following resource(s) failed to create: [MyEC2Instance]'. What is the first step the developer should take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

View the stack events in the CloudFormation console to see the specific error for the resource.. When a CloudFormation stack fails to create, the error message only indicates which resource failed, not why. The first troubleshooting step is to view the stack events in the CloudFormation console, which provides detailed error messages for each resource, such as an API call failure, insufficient permissions, or a resource limit exceeded. This allows the developer to diagnose the root cause before making any changes.

Answer

Update the stack with a new template.

Answer

Delete the stack and try again.

Answer

Review the CloudFormation template for syntax errors.

Question 2

An application running on Amazon ECS with Fargate is unable to pull an image from Amazon ECR. The task definition uses the 'default' task execution role. What is the most likely cause?

Accepted Answer

The task execution role does not have permissions to pull from ECR.. When using Amazon ECS with Fargate, the task execution role (not the task role) is responsible for pulling container images from Amazon ECR. The 'default' task execution role is created automatically but lacks the necessary permissions (e.g., ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:BatchCheckLayerAvailability) unless explicitly attached via an IAM policy. Since the question states the task definition uses the 'default' task execution role, the most likely cause is that this role does not have the required ECR permissions.

Answer

The task role does not have permissions to access ECR.

Answer

The ECS cluster does not have permissions to access ECR.

Answer

The ECS service role does not have permissions to access ECR.

Question 3

Refer to the exhibit. An IAM policy is attached to a user. The user tries to download an object from s3://my-bucket/secret/config.txt. What will happen?

Accepted Answer

The user is denied access because the Deny statement explicitly denies access to the 'secret/' prefix.. The Deny statement explicitly denies all s3 actions on the 'secret/' prefix. Deny statements override Allow statements. Therefore, the user is denied access to objects under the 'secret/' prefix, including s3://my-bucket/secret/config.txt. Option D is correct. Option A is incorrect because the explicit Deny overrides any bucket policy allow. Option B is incorrect because the Deny applies to all s3 actions, including s3:GetObject, and is scoped to the 'secret/' prefix. Option C is incorrect because the Allow statement does not grant access to the 'secret/' prefix; the Deny overrides it.

Answer

The user is denied access only if the bucket policy also denies access.

Answer

The user can download the object because the Deny statement only applies to 's3:*' actions, not s3:GetObject.

Answer

The user can download the object because the Allow statement grants s3:GetObject on the bucket.

Question 4

A developer is using Amazon S3 to host a static website. The website returns 403 Forbidden errors. The bucket policy allows public read access. What is the most likely cause?

Accepted Answer

The bucket's 'Block public access' settings are enabled.. The most likely cause is that the bucket's 'Block public access' settings are enabled. Even if the bucket policy explicitly grants public read access, S3's Block Public Access settings act as an overarching security override that denies all public requests, resulting in a 403 Forbidden error. These settings are enabled by default for new buckets and can be applied at the account or bucket level, making them a common pitfall.

Answer

The bucket has an ACL that denies read access.

Answer

The bucket policy does not include the 's3:GetObject' action.

Answer

The bucket policy is not correctly attached to the bucket.

Question 5

An application running on Amazon ECS Fargate is experiencing intermittent connection timeouts when calling an external API. The task has a public IP and a security group that allows outbound HTTPS. What is the most likely cause?

Accepted Answer

The task is running in a private subnet without a NAT gateway.. ECS Fargate tasks running in a private subnet do not have direct internet access. Without a NAT gateway, outbound traffic to the external API is routed to the subnet’s route table, which lacks an internet gateway target, causing connection timeouts. The task’s public IP assignment is irrelevant in a private subnet, as the subnet itself has no route to the internet.

Answer

The ECS service is not configured to auto-assign public IP.

Answer

The task's security group does not allow inbound traffic.

Answer

The security group outbound rules are misconfigured.

Question 6

A developer is troubleshooting an AWS Lambda function that is triggered by an Amazon SQS queue. The function processes messages but occasionally fails. The failed messages are not being sent to the dead-letter queue (DLQ). What is the most likely reason?

Accepted Answer

The SQS queue's redrive policy is not configured.. When Lambda is triggered by SQS, the recommended approach is to configure a dead-letter queue (DLQ) on the SQS queue itself using a redrive policy. This ensures that messages that fail processing after reaching the maximum receive count are automatically moved to the DLQ. Option B is correct because the absence of a redrive policy means failed messages remain in the main queue or are discarded, not sent to a DLQ. Option D is incorrect; configuring a DLQ on the Lambda function is intended for asynchronous invocations, not SQS-triggered Lambda. Option A is incorrect because the redrive policy does not rely on Lambda's IAM role; it is a configuration on the SQS queue. Option C is incorrect because reserved concurrency set to 0 would prevent all invocations, but the issue described is about occasional failures, not complete lack of invocation.

Answer

The Lambda function's execution role does not have permission to send messages to the DLQ.

Answer

The Lambda function's reserved concurrency is set to 0.

Answer

The Lambda function does not have a dead-letter queue configured.

Question 7

Which TWO approaches can be used to optimize costs for an Amazon DynamoDB table with predictable read/write patterns? (Select TWO.)

Accepted Answer

Use provisioned capacity with auto scaling.. Optimizing costs for DynamoDB with predictable workloads involves avoiding over-provisioning and reducing read/write consumption. Provisioned capacity with auto scaling (B) adjusts capacity based on actual usage, preventing unnecessary spending on unused capacity. DynamoDB Accelerator (DAX) (D) caches frequent reads, reducing read capacity unit consumption. Option A (increasing RCU) leads to over-provisioning and higher costs. Option C (global tables) adds replication costs. Option E (on-demand) is more expensive than provisioned for predictable patterns.

Answer

Increase the read capacity units to avoid throttling.

Answer

Use DynamoDB global tables for multi-region replication.

Answer

Use on-demand capacity mode.

Question 8

A developer deployed a new version of a Lambda function that processes S3 events. After deployment, some S3 events are not being processed. The CloudWatch Logs show no errors. What is the most likely cause?

Accepted Answer

The S3 bucket's event notification still points to the old Lambda function.. After deploying a new version of a Lambda function, the S3 bucket's event notification configuration still references the Amazon Resource Name (ARN) of the old Lambda function version or the function without a qualifier. S3 event notifications are configured to invoke a specific Lambda function ARN, and if the ARN does not point to the new version (e.g., by using an alias or the $LATEST qualifier), events will continue to be sent to the old version, which may not be processing them. Since CloudWatch Logs show no errors, the old version is likely not being invoked or is not logging, confirming the mismatch.

Answer

The Lambda function has a syntax error.

Answer

The Lambda function alias is not pointing to the new version.

Answer

The S3 events are being throttled by Lambda.

Question 9

A developer is using AWS X-Ray to trace a Lambda function that calls DynamoDB and SQS. Some traces show errors. Which TWO actions should the developer take to diagnose the issue?

Accepted Answer

Examine the trace details for exception messages.. To diagnose errors in existing X-Ray traces, the developer should examine trace details (Option A) to see exception messages and stack traces for each segment, and check the service map (Option C) for error edges that indicate which service interactions failed. Option B is about enabling X-Ray permissions, which is a prerequisite for tracing but does not help diagnose errors in traces that are already captured. Option D (disabling sampling) is unnecessary because X-Ray captures errors by default regardless of sampling. Option E (CloudFront caching) is unrelated to trace diagnostics.

Answer

Verify that the Lambda function's IAM role has permissions for X-Ray.

Answer

Disable X-Ray sampling to capture all requests.

Answer

Enable CloudFront to cache responses.

Question 10

A developer is troubleshooting a slow RDS MySQL instance. Which TWO metrics in Amazon CloudWatch should the developer examine first?

Accepted Answer

CPUUtilization. The correct metrics to examine first for a slow RDS MySQL instance are CPUUtilization and ReadLatency. High CPUUtilization indicates that the instance is under heavy load, possibly from inefficient queries or inadequate compute capacity. High ReadLatency suggests slow I/O, which could be due to disk contention or suboptimal queries. NetworkReceiveThroughput (A) is related to network traffic, not database performance. SwapUsage (B) is not typically a primary metric for RDS performance. FreeStorageSpace (D) indicates storage capacity but does not directly measure performance. Therefore, options C and E are the correct choices.

Answer

NetworkReceiveThroughput

Answer

SwapUsage

Answer

FreeStorageSpace

Question 11

Refer to the exhibit. A developer created this CloudFormation template. After deployment, the stack creation fails with 'Bucket name already exists'. What should the developer do to fix the issue?

Accepted Answer

Change the BucketName to include a random suffix.. The error 'Bucket name already exists' indicates that the S3 bucket name is not unique. Adding a random suffix to the BucketName (e.g., using AWS::StackName or a random string) ensures uniqueness. Option B is incorrect because removing the queue does not address the bucket naming conflict. Option C is incorrect because disabling versioning does not affect the bucket name. Option D is incorrect because disabling SSE is unrelated to the bucket name conflict.

Answer

Remove the MyQueue resource.

Answer

Remove the VersioningConfiguration from the bucket.

Answer

Set SqsManagedSseEnabled to false.

Question 12

Which TWO actions can help reduce the cold start time for an AWS Lambda function? (Choose 2)

Accepted Answer

Increase the function's memory allocation. Options B and D are correct. Increasing the function's memory allocation also increases CPU and network throughput, which can speed up initialization and reduce cold start time. Implementing a scheduled CloudWatch Event to invoke the function every 5 minutes keeps the function warm by preventing the container from being reclaimed, minimizing cold starts. Option A is incorrect because placing the function in a VPC adds latency due to ENI creation, increasing cold start time. Option C is incorrect because a larger deployment package increases download time, worsening cold starts. Option E is incorrect because provisioned concurrency eliminates cold starts entirely, but it's a different solution that requires additional cost; the question asks for actions that reduce cold start time, and provisioned concurrency is a separate feature.

Answer

Place the Lambda function in a VPC

Answer

Use a larger deployment package with all dependencies included

Answer

Use provisioned concurrency to pre-warm the function

Question 13

A developer notices that an AWS Lambda function configured with a VPC is timing out when trying to access an Amazon S3 bucket. The function has the necessary IAM permissions. What is the most likely cause?

Accepted Answer

The Lambda function does not have a route to the internet or a VPC endpoint for S3.. The function times out because it cannot reach S3. Since the function is in a VPC, it does not have internet access by default. To access S3, it requires either a NAT gateway/instance and an internet gateway, or a VPC endpoint for S3. Option A is incorrect because Lambda functions can be configured inside a VPC; they just need proper networking. Option B is incorrect because the question states the function has the necessary IAM permissions, so the execution role is not the issue. Option D is incorrect because security groups are stateful and typically allow outbound traffic; the more likely cause is missing routing to S3. Option C correctly identifies the missing route or endpoint.

Answer

Lambda functions cannot be configured inside a VPC.

Answer

The Lambda function's execution role lacks S3 permissions.

Answer

The security group attached to the Lambda function does not allow outbound traffic to S3.

Question 14

A developer is troubleshooting an AWS Elastic Beanstalk environment that is failing health checks. The environment runs a web application on Tomcat. The developer checks the logs and finds no errors. What is the most likely cause of the health check failure?

Accepted Answer

The application's health check URL is returning a non-200 status code.. The most likely cause is that the application's health check URL is returning a non-200 status code. Elastic Beanstalk uses the load balancer to perform health checks against a configurable path (default: /). If the application responds with any status other than 200 OK, the load balancer marks the instance as unhealthy, even if the application logs show no errors. This is a common misconfiguration where the health check endpoint is not implemented or returns an unexpected status.

Answer

The security group for the instances does not allow traffic from the load balancer.

Answer

The application is throwing exceptions that are not logged.

Answer

The application is listening on a port other than 80.

Question 15

A developer is using Amazon DynamoDB for a new application. The developer wants to reduce read latency. Which design pattern should the developer use?

Accepted Answer

Use DynamoDB Accelerator (DAX) as a cache for frequently read items.. DynamoDB Accelerator (DAX) is an in-memory cache designed specifically for DynamoDB, providing microsecond read latency for frequently accessed items. By caching read-heavy workloads, DAX offloads requests from the DynamoDB table, reducing read latency without requiring application-level caching logic. This directly addresses the developer's goal of reducing read latency.

Answer

Create a global secondary index (GSI) for the table.

Answer

Increase the provisioned read capacity units (RCUs) for the table.

Answer

Use DynamoDB Global Tables to replicate data to multiple regions.