DVA-C02 Troubleshooting and Optimization Practice Test 19 — 15 Questions

Question 1

A company is using CloudFront with an S3 origin to serve static content. Users in some geographic regions experience high latency. The developer wants to optimize performance. Which THREE actions should the developer take?

Accepted Answer

Increase the TTL for the cache behavior to reduce requests to the origin.. Option A is correct: adding more edge locations (through additional origins) is not possible directly, but optimizing the origin is. Actually, CloudFront has many edge locations, but adding more origins doesn't help. Option B is correct: enabling origin shield reduces load on the origin. Option C is correct: using multiple origins and failover can improve availability. Option D is wrong: S3 Transfer Acceleration is for uploading to S3, not for CloudFront. Option E is wrong: TTL does not affect latency, only cache hit ratio.

Answer

Enable S3 Transfer Acceleration for the origin bucket.

Answer

Add additional CloudFront edge locations in the affected regions.

Question 2

A developer is debugging an application that uses Amazon SQS. The application occasionally processes the same message twice. Which TWO configurations can help prevent duplicate processing?

Accepted Answer

Increase the visibility timeout to ensure messages are deleted before becoming visible again.. Option A is correct: enabling content-based deduplication for FIFO queues ensures exactly-once processing. Option B is correct: increasing the visibility timeout gives the consumer more time to process and delete the message before it becomes visible again. Option C is wrong: increasing the delivery delay only delays the first delivery. Option D is wrong: enabling long polling improves efficiency but does not prevent duplicates. Option E is wrong: using a dead-letter queue handles failed messages, not duplicates.

Answer

Configure a dead-letter queue to capture duplicates.

Answer

Increase the delivery delay to defer message processing.

Answer

Enable long polling to reduce empty responses.

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application stores session data in an RDS MySQL database. Recently, users have reported that they are being logged out unexpectedly and their session data is lost. The developer investigates and finds that the RDS instance's CPU utilization spikes periodically, coinciding with the logout events. The application uses connection pooling via an RDS Proxy. The developer suspects that the session table is being dropped or truncated. After checking the application logs, the developer finds no evidence of truncation commands. The RDS instance has automated backups enabled, and the binary logs are retained for 24 hours. The developer wants to identify the root cause and prevent future occurrences. Which course of action should the developer take?

Accepted Answer

Check the session table's storage engine; if it uses MEMORY, change it to InnoDB to persist data across restarts.. The RDS CPU spikes and session loss suggest that the database is being restarted or failing over, causing in-memory session data to be lost. However, the session data is stored in a table, which should survive restarts. The issue might be that the session table is using the MEMORY storage engine, which loses data on restart. Option C is correct: checking the table storage engine. Option A is wrong because RDS Proxy does not cause data loss. Option B is wrong because binary logs are for replication, not session persistence. Option D is wrong because increasing instance size may delay but not prevent the issue.

Answer

Enable Multi-AZ deployment for RDS to improve availability and prevent data loss during failover.

Answer

Increase the RDS instance size to handle the CPU spikes and prevent future issues.

Answer

Disable RDS Proxy and implement connection pooling in the application code to reduce database load.

Question 4

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and several Lambda functions. The developer runs 'sam deploy' and the deployment succeeds. However, when the developer tests the API endpoint using curl, the request times out. The CloudWatch logs for the Lambda function show that the function is not being invoked. The API Gateway logs are not enabled. The developer checks the API Gateway console and sees that the integration type is 'AWS Service' instead of 'Lambda Function'. The developer used the following SAM template snippet:

Resources:
  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      DefinitionBody:
        swagger: 2.0
        info:
          title: My API
        paths:
          /items:
            get:
              x-amazon-apigateway-integration:
                type: aws_proxy
                uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFunction.Arn}/invocations
              responses: {}
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src
      Handler: index.handler
      Runtime: nodejs14.x
      Events:
        ApiEvent:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /items
            Method: GET

What is the most likely cause of the timeout?

Accepted Answer

The API Gateway integration type is misconfigured; the SAM template should use 'AWS::Serverless::Function' event source instead of manual Swagger integration.. The SAM template defines the API using both the 'AWS::Serverless::Api' resource with a Swagger definition inline and the 'AWS::Serverless::Function' with an Api event. This may cause a conflict or incorrect configuration. Option D is correct: the 'x-amazon-apigateway-integration' type is set to 'aws_proxy' but the URI is incorrect. However, the API Gateway integration type shown as 'AWS Service' indicates that the integration was not properly set up. The most likely cause is that the SAM template incorrectly defines the integration, leading to a misconfiguration. Option A is wrong because the timeout is not due to Lambda limits. Option B is wrong because the code is not invoked. Option C is wrong because the API is correctly set up for public access.

Answer

The API Gateway endpoint is not publicly accessible due to a resource policy.

Answer

The Lambda function's code is throwing an unhandled exception before it can log.

Answer

The Lambda function has reached the concurrency limit.

Question 5

A developer notices that an S3 bucket's 'PutObject' API calls are failing intermittently for a specific application. The application uses the AWS SDK for Java to upload files. The error message is 'RequestTimeout: Your socket connection to the server was not read from or written to within the timeout period.' The bucket is in the same region as the application. The developer checks the S3 metrics and sees no throttling errors. The application runs on EC2 instances behind an ALB. The developer suspects a network issue. What should the developer do to resolve the issue?

Accepted Answer

Increase the socket timeout in the AWS SDK configuration and ensure the network path (ALB) has a higher idle timeout.. The 'RequestTimeout' error indicates that the connection is idle for too long. This often happens when using a proxy or load balancer that has a shorter idle timeout than the S3 SDK's timeout. Option A is correct: increasing the S3 client's timeout settings or using HTTP keep-alive. Option B is wrong because the bucket policy is not related to timeouts. Option C is wrong because S3 Transfer Acceleration is for large files over long distances, not for timeouts. Option D is wrong because the issue is not about permissions.

Answer

Add a bucket policy that grants s3:PutObject to the application's IAM role.

Answer

Use an S3 VPC endpoint to improve network reliability.

Answer

Enable S3 Transfer Acceleration on the bucket and update the application to use the accelerated endpoint.

Question 6

A developer is troubleshooting a Lambda function that occasionally times out. The function makes HTTPS calls to an external API. Which configuration change is MOST likely to resolve the issue without increasing the risk of further timeouts?

Accepted Answer

Increase the function's timeout setting.. Option B is correct because adjusting the timeout setting gives the function more time to complete the external API call. Option A is wrong because increasing memory/CPU won't help if the external API is slow. Option C is wrong because synchronous invocation is not relevant to timeout. Option D is wrong because reducing timeout would worsen the issue.

Answer

Increase the function's memory allocation.

Answer

Decrease the function's reserved concurrency.

Answer

Change the function invocation type to synchronous.

Question 7

A web application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The ALB target group health checks are succeeding. Which step should the developer take FIRST to diagnose the issue?

Accepted Answer

Examine the ALB access logs for 503 responses.. Option D is correct because examining ALB access logs can reveal the response status codes and request details. Option A is wrong because health checks succeed. Option B is wrong because increasing instances may not address the root cause. Option C is wrong because the issue is with the ALB, not DNS.

Answer

Increase the number of EC2 instances in the target group.

Answer

Check the Route 53 record for the ALB.

Answer

Verify that the EC2 instances are in a running state.

Question 8

A developer is using Amazon API Gateway with a Lambda authorizer to protect a REST API. The authorizer is configured with a TTL of 300 seconds. After updating the IAM policy attached to the authorizer's execution role, some users still receive 403 Forbidden errors for requests that should be allowed. What is the MOST likely cause?

Accepted Answer

The authorizer's cached results are still valid, so the old policy is being applied.. Option C is correct because the Lambda authorizer result is cached for 300 seconds, so old permissions are enforced until the cache expires. Option A is wrong because the authorizer function itself does not have an execution timeout issue. Option B is wrong because the IAM policy update is immediate for the role, but the authorizer result is cached. Option D is wrong because the deployment does not affect authorizer caching.

Answer

The Lambda authorizer function has a timeout that prevents it from evaluating the new policy.

Answer

The IAM policy update has not propagated to all regions.

Answer

The API Gateway endpoint was not redeployed after the policy change.

Question 9

A developer notices that an S3 bucket configured for static website hosting returns 403 Forbidden errors when accessed from a browser. The bucket policy allows s3:GetObject for principal "*" but only over HTTPS. What is the MOST likely reason for the error?

Accepted Answer

The request was sent over HTTP instead of HTTPS.. Option D is correct because the bucket policy condition requires HTTPS, but the browser may have used HTTP. Option A is wrong because the bucket policy does not require authentication. Option B is wrong because the website endpoint does not support HTTPS by default. Option C is wrong because the bucket policy explicitly allows GetObject.

Answer

The requester is not authenticated with AWS IAM.

Answer

The bucket policy denies s3:GetObject for anonymous principals.

Answer

The S3 bucket website endpoint does not support HTTPS.

Question 10

A developer is running a Docker container on Amazon ECS with Fargate. The container logs are not appearing in CloudWatch Logs even though the task definition has a logConfiguration specifying the awslogs driver and a log group. What is the MOST likely missing configuration?

Accepted Answer

The task execution role lacks the necessary IAM permissions to write to CloudWatch Logs.. Option A is correct because the task execution role must have permissions to write to CloudWatch Logs. Option B is wrong because the container is running in Fargate, so there is no EC2 instance profile. Option C is wrong because the log driver is specified in the task definition, not in the container image. Option D is wrong because the log group already exists in the configuration.

Answer

The container image does not have the awslogs log driver installed.

Answer

The CloudWatch Logs log group does not exist.

Answer

The EC2 instance profile does not have CloudWatch Logs permissions.

Question 11

A developer is troubleshooting an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function processes new objects and writes results to a DynamoDB table. Recently, some objects are not being processed. The developer checks the CloudWatch Logs for the Lambda function and sees no errors. Which TWO actions should the developer take to investigate the issue?

Accepted Answer

Check the S3 bucket notification configuration to ensure it is properly set for the correct events.. Options B and D are correct. Option B: S3 event notifications can fail if the event is not configured correctly; checking the bucket notification configuration ensures the events are being sent. Option D: Lambda dead-letter queues (DLQ) capture events that failed to be processed; if configured, they can reveal unprocessed events. Option A is wrong because the function logs show no errors, indicating the function is not invoked for those objects. Option C is wrong because DynamoDB stream is not involved in this flow. Option E is wrong because the function is invoked, but the issue is before invocation.

Answer

Enable DynamoDB Streams on the table and process records.

Answer

Increase the Lambda function's memory allocation.

Answer

Review the Lambda function's CloudWatch Logs for timeout messages.

Question 12

A developer is using Amazon RDS for MySQL and notices that the database performance has degraded. The developer suspects that slow queries are the cause. Which THREE actions should the developer take to identify and address the slow queries?

Accepted Answer

Enable the slow query log in RDS and review the logs.. Options A, C, and E are correct. Option A: Enabling slow query log captures queries that exceed a threshold. Option C: Performance Insights provides a dashboard to identify database load and wait events. Option E: Reviewing queries with high latency helps pinpoint problematic SQL. Option B is wrong because increasing instance size is a reactive scaling action, not a diagnostic step. Option D is wrong because read replicas help with read scaling, not diagnosing slow queries.

Answer

Increase the DB instance size to improve performance.

Answer

Create a read replica to offload read traffic.

Question 13

An application running on Amazon ECS with Fargate is experiencing intermittent failures when connecting to an Amazon RDS database. The security group for the RDS instance allows inbound traffic from the security group attached to the ECS tasks. Which TWO additional checks should the developer perform to troubleshoot the connectivity issue?

Accepted Answer

Verify that the security group for the RDS instance has an inbound rule allowing traffic from the security group used by the ECS tasks.. Options A and D are correct. Option A: The RDS security group must allow inbound traffic from the ECS task security group; this is already stated, but verifying the exact configuration is important. Option D: The NACL for the subnets must allow ephemeral ports for the response traffic. Option B is wrong because the ECS tasks are in a private subnet, so an Internet Gateway is not used for RDS connectivity. Option C is wrong because the database credentials are not related to network connectivity. Option E is wrong because VPC Flow Logs are useful for analyzing traffic but not a first check; the question asks for additional checks after security group.

Answer

Enable VPC Flow Logs to capture dropped packets.

Answer

Check that the database credentials are correctly stored in AWS Secrets Manager.

Answer

Ensure that the ECS tasks have a route to the internet through an Internet Gateway.

Question 14

A developer attached the IAM policy above to an IAM user. The user reports that they receive an AccessDenied error when trying to upload a file to the S3 bucket using the AWS CLI without specifying any server-side encryption. What is the reason for the error?

Accepted Answer

The request does not include the required server-side encryption header.. Option B is correct because the policy requires s3:x-amz-server-side-encryption to be AES256. If not specified, the condition fails and the request is denied. Option A is wrong because the resource is correct. Option C is wrong because the action is allowed. Option D is wrong because putting an object without encryption does not match the condition.

Answer

The policy does not allow the s3:PutObject action on the bucket itself.

Answer

The IAM user does not have permissions to use the s3:PutObject action.

Answer

The bucket policy overrides the IAM policy.

Question 15

A developer runs the AWS CLI command above to view the latest log stream for a Lambda function. The output shows a log stream with lastEventTimestamp of 1710493200000 (approximately 1 hour ago). However, the function was invoked 5 minutes ago and did not produce any errors. What is the MOST likely explanation?

Accepted Answer

The command returned only the oldest log stream because of the limit and ordering parameters.. Option D is correct because the command only returns one log stream due to the limit 1 parameter. There may be newer log streams that are not shown. Option A is wrong because the function did not fail. Option B is wrong because the log stream exists. Option C is wrong because the function was invoked recently.

Answer

The Lambda function was not actually invoked 5 minutes ago.

Answer

The Lambda function execution role lacks permissions to write to CloudWatch Logs.

Answer

The log stream was deleted after the last invocation.