DVA-C02 Troubleshooting and Optimization Practice Test 2 — 15 Questions

Question 1

An API Gateway API returns 429 errors during load testing. Which two areas should the developer investigate first?

Accepted Answer

Usage plan or stage throttling limits. A is correct because API Gateway uses usage plans and stage-level throttling to limit request rates. When a client exceeds the configured rate limit (e.g., 10,000 requests per second) or burst limit, API Gateway returns a 429 Too Many Requests error. Investigating these limits is the first step to identify if the load test is hitting predefined caps.

Answer

S3 lifecycle expiration rules

Answer

CloudFormation stack drift only

Question 2

An SQS-triggered Lambda repeatedly processes the same poison message. Which two settings help contain the issue?

Accepted Answer

Configure maxReceiveCount and a dead-letter queue. To contain and resolve the issue of poison messages in an SQS-triggered Lambda, two key configurations are used:

1. **Configure maxReceiveCount and a Dead-Letter Queue (DLQ) (Option A):** By setting a Redrive Policy with a `maxReceiveCount`, SQS will automatically move a message to a DLQ after it has been received and failed the specified number of times. This prevents the poison message from looping indefinitely.

2. **Use partial batch response / ReportBatchItemFailures (Option C):** By enabling 'ReportBatchItemFailures' on the Lambda event source mapping, the function can return a list of specific failed message IDs. SQS will only retry those failed messages (the poison message) rather than retrying the entire batch, which prevents successful messages in the same batch from being repeatedly reprocessed.

Answer

Disable CloudWatch Logs

Answer

Set message retention to zero

Question 3

Drag and drop the steps to troubleshoot an application that cannot connect to an RDS database in the correct order.

Accepted Answer

Step 1: Check network connectivity, Step 2: Check security groups, Step 3: Check credentials, Step 4: Test direct connection, Step 5: Check database logs. To troubleshoot RDS connection issues, follow a logical bottom-up approach: 
1. **Verify DB instance status**: Ensure the database is in the 'available' state.
2. **Check security groups and network ACLs**: Ensure the database security group allows inbound traffic on the database port from the application's security group or IP.
3. **Test port connectivity**: Use tools like `nc` or `telnet` to verify if the port is reachable. This isolates network/firewall issues from authentication issues.
4. **Verify database credentials**: Once network connectivity is confirmed, verify that the username, password, and database name are correct.
5. **Check database logs**: If the connection still fails or is dropped, inspect the DB logs (e.g., error logs) for engine-specific issues or connection limits.

Answer

Step 1: Check credentials, Step 2: Check security groups, Step 3: Check network connectivity, Step 4: Test direct connection, Step 5: Check database logs

Answer

Step 1: Check security groups, Step 2: Check network connectivity, Step 3: Check credentials, Step 4: Check database logs, Step 5: Test direct connection

Answer

Step 1: Check network connectivity, Step 2: Check credentials, Step 3: Check security groups, Step 4: Test direct connection, Step 5: Check database logs

Question 4

A company uses AWS CodePipeline with CodeBuild to deploy a Node.js application. The build fails intermittently with 'npm ERR! network' errors. What is the most likely cause and solution?

Accepted Answer

The build environment lacks outbound internet access; configure a NAT gateway or use a VPC endpoint for npm.. The 'npm ERR! network' error indicates that npm cannot reach the registry to download packages. If AWS CodeBuild is configured to run inside a VPC, it requires outbound internet access to reach the public npm registry. If CodeBuild is configured with multiple subnets and some of them lack a route to a NAT gateway, the builds will fail intermittently depending on which subnet the build container is provisioned in. To resolve this, ensure all configured subnets have a route to a NAT gateway, or host your packages in AWS CodeArtifact and use a VPC endpoint to access them privately.

Answer

A unit test is failing; fix the test code.

Answer

The npm cache is corrupted; clear the cache in CodeBuild.

Answer

The npm token has expired; regenerate the token.

Question 5

A developer receives an AccessDeniedException when trying to invoke a Lambda function from an Amazon API Gateway REST API. The Lambda resource-based policy allows API Gateway. What is the most likely issue?

Accepted Answer

The API Gateway execution role lacks lambda:InvokeFunction permission.. When API Gateway invokes a Lambda function, it must have the `lambda:InvokeFunction` permission. Even if the Lambda resource-based policy grants API Gateway access, the API Gateway execution role must also explicitly allow the `lambda:InvokeFunction` action. Without this permission, API Gateway cannot invoke the function, resulting in an AccessDeniedException.

Answer

The Lambda function is in a VPC without a NAT gateway.

Answer

The Lambda function concurrency limit is exceeded.

Answer

API Gateway caching is enabled, returning stale responses.

Question 6

A developer is optimizing costs for an S3 bucket that stores infrequently accessed data but requires millisecond retrieval. The bucket receives 100 PUT requests per second and 10 GET requests per second. Which storage class is most cost-effective?

Accepted Answer

S3 Standard. With 100 PUT requests per second, the bucket receives approximately 259.2 million PUT requests per month. S3 Standard-IA charges double the PUT request fee ($0.01 per 1,000 requests) compared to S3 Standard ($0.005 per 1,000 requests), resulting in an extra $1,296 per month in request fees alone. S3 Intelligent-Tiering charges a monitoring and automation fee of $0.0025 per 1,000 objects per month, which would add $648 per month for every 259.2 million objects stored, compounding over time. Therefore, despite the data being infrequently accessed, S3 Standard is the most cost-effective storage class due to the high volume of PUT requests.

Answer

S3 One Zone-IA

Answer

S3 Glacier Deep Archive

Answer

S3 Intelligent-Tiering

Question 7

An IAM user has the above policy attached. The user tries to stop an EC2 instance. What happens?

Accepted Answer

The stop operation succeeds.. The question refers to an 'above policy' but does not include the actual policy JSON. The provided explanation describes a policy that allows ec2:StopInstances and denies ec2:TerminateInstances, but that policy is not present in the question, making it impossible for the candidate to determine the correct answer. The answer may be correct for that described policy, but the question as written is incomplete.

Answer

The stop operation fails because ec2:StopInstances is not allowed explicitly.

Answer

The stop operation fails because of the Deny statement.

Answer

The stop operation fails because the policy is invalid (conflict).

Question 8

A developer runs the above CLI command to check a Lambda function's logs. The function is invoked but no logs appear in CloudWatch. The IAM role for the Lambda function has the AWSLambdaBasicExecutionRole managed policy attached. What is the most likely cause?

Accepted Answer

The log group's retention policy has deleted older logs.. The most likely cause is that the log group's retention policy has deleted older logs. The Lambda function has the AWSLambdaBasicExecutionRole, which grants permissions to create log groups and log streams, and to put log events. Therefore, option C is incorrect. Option B is unlikely because CloudWatch Logs is enabled by default in all regions. Option D is incorrect because the developer states the function is being invoked. The logs may have been created but then deleted due to a retention policy, making them invisible to the developer. Option A correctly identifies this as the most likely cause.

Answer

The CloudWatch Logs service is not enabled in the region.

Answer

The Lambda function's IAM role does not have permission to create log groups.

Answer

The Lambda function is not being invoked.

Question 9

Which THREE are valid methods to handle application configuration in AWS? (Choose three.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is a valid method for handling application configuration because it securely stores and manages sensitive configuration data such as database credentials, API keys, and other secrets. It supports automatic rotation of secrets, fine-grained access control via IAM policies, and integrates with AWS services like RDS, Redshift, and Lambda. This makes it ideal for managing dynamic configuration values that require high security and lifecycle management.

Answer

AWS CloudFormation template parameters

Answer

AWS IAM roles

Question 10

Which TWO are best practices for optimizing DynamoDB performance? (Choose two.)

Accepted Answer

Use SQS to decouple write-heavy workloads and handle spikes.. Using SQS to decouple write-heavy workloads allows DynamoDB to absorb traffic spikes by buffering writes in a queue, preventing throttling and enabling batch processing. This pattern, often called 'queue-based load leveling,' ensures that DynamoDB's provisioned capacity is not overwhelmed by sudden bursts, improving overall system resilience and cost efficiency.

Answer

Provision maximum write capacity units to handle any spike.

Answer

Use Scan operations instead of Query for retrieving data.

Answer

Enable strongly consistent reads for all read operations.

Question 11

A company runs a serverless application using AWS Lambda and Amazon API Gateway. The application experiences intermittent 502 Bad Gateway errors. The Lambda function logs show no errors. What is the most likely cause?

Accepted Answer

The Lambda function execution time exceeds API Gateway's 29-second timeout.. A 502 Bad Gateway error indicates that API Gateway received an invalid response from the backend integration (Lambda). When using Lambda proxy integration, the Lambda function must return a JSON object with specific fields, such as 'statusCode' and 'body'. If the function returns a plain string or an incorrectly formatted JSON object, API Gateway cannot parse it and returns a 502 Bad Gateway error. Because the Lambda function itself executed successfully and did not throw an exception, the Lambda logs will show no errors.

Answer

The API Gateway account-level throttling limit is exceeded.

Answer

The Lambda function is throwing unhandled exceptions.

Answer

The API Gateway request payload exceeds 10 MB.

Question 12

A developer is troubleshooting a slow Amazon DynamoDB table. The table has a read capacity of 1000 RCU and a write capacity of 500 WCU. The application frequently reads the same item. Which TWO actions can improve read performance?

Accepted Answer

Implement DynamoDB Accelerator (DAX) for caching.. DynamoDB Accelerator (DAX) is an in-memory cache that can reduce read latency for frequently accessed items from milliseconds to microseconds, offloading read traffic from the table and improving performance without requiring a capacity increase. Option E is correct because eventually consistent reads consume half the RCU of strongly consistent reads (0.5 RCU vs 1 RCU per 4 KB item) and return data faster, which is suitable when the application can tolerate slightly stale data for the same item.

Answer

Increase the read capacity units (RCU) to 2000.

Answer

Add a Global Secondary Index (GSI) on the frequently read attribute.

Answer

Decrease the write capacity units (WCU) to 250.

Question 13

A company uses AWS Step Functions to orchestrate a workflow. The workflow is failing with a 'States.ALL' error. Which THREE steps should the developer take to troubleshoot?

Accepted Answer

Review the state machine definition for syntax errors.. Step Functions throws specific errors such as States.Timeout, States.TaskFailed, States.Permissions, or custom errors. States.ALL is only a catch-all pattern in Retry/Catch, not an error you see in execution history. Troubleshooting should focus on the actual error name and the execution history in the Step Functions console. While reviewing the state machine definition, checking execution history, and verifying IAM permissions are generally useful, they are not specifically linked to a 'States.ALL' error as described.

Answer

Increase the memory allocated to the Lambda functions in the workflow.

Answer

Enable AWS X-Ray tracing on the state machine.

Question 14

A web application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. Which TWO steps should be taken to diagnose the issue?

Accepted Answer

Check the CPU utilization of the EC2 instances.. High CPU utilization on EC2 instances can cause them to become unresponsive or fail to respond to health checks within the ALB's configured timeout, leading to 503 errors. The ALB routes traffic only to healthy targets; if instances are overwhelmed, they may fail health checks or drop requests, resulting in a 503 response to clients.

Answer

Check the Route 53 health checks for the domain.

Answer

Check the security group rules for the ALB.

Answer

Check the EBS volume type of the EC2 instances.

Question 15

Refer to the exhibit. The developer runs the AWS CLI command to invoke a Lambda function. The output shows 'FunctionError': 'Unhandled'. What should the developer do to get more details about the error?

Accepted Answer

Decode the base64-encoded 'LogResult' field to view the log output.. The 'LogResult' field in the Lambda invocation output contains a base64-encoded log. Decoding it provides the error details, making Option C the correct choice. Option A is incorrect because an 'Unhandled' error typically indicates a code exception, not necessarily an invalid payload. Option B is incorrect because AWS X-Ray provides tracing but not the detailed error log from the invocation result. Option D is incorrect because while CloudWatch Logs stores logs, the question asks how to get more details directly from the CLI output, and decoding LogResult is the immediate method.

Answer

Re-invoke the function with a valid payload because the error is due to invalid input.

Answer

Enable AWS X-Ray tracing on the function.

Answer

Check the CloudWatch Logs for the function's log group.