DVA-C02 Troubleshooting and Optimization Practice Test 4 — 15 Questions

Question 1

A company is running a serverless application using AWS Lambda and Amazon API Gateway. The application experiences increased latency during peak hours. CloudWatch metrics show that Lambda function duration remains stable, but API Gateway latency spikes. Which THREE actions should the developer take to reduce API Gateway latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable compression for API responses.. Option B is correct because enabling response compression (e.g., gzip via the minimumCompressionSize setting) reduces the payload size transferred over the network, which directly lowers the time clients spend downloading responses and thus reduces observed API Gateway latency. Option D is correct because enabling API Gateway caching stores endpoint responses in the stage cache, so repeated requests are served from cache instead of invoking the backend, cutting the per-request latency that spikes during peak hours. Option E is correct because switching from an Edge-optimized endpoint to a Regional endpoint removes the CloudFront distribution layer and routes traffic directly to the regional endpoint, which can reduce latency for clients located near the region. Option A is not correct because Lambda duration is already stable and increasing the timeout does not affect API Gateway latency. Option C is not correct because raising throttling limits only allows more requests through and does not reduce the latency of individual requests.

Answer

Increase the Lambda function timeout.

Answer

Increase the API Gateway throttling limits.

Question 2

A developer is deploying a new microservice on AWS Elastic Beanstalk. The service uses an RDS database. The developer wants to ensure that database credentials are not stored in the application's source code. Which TWO methods should the developer use to securely provide credentials to the application?

Accepted Answer

Use AWS Secrets Manager to store and retrieve the credentials at runtime.. Option A is correct because AWS Secrets Manager is designed to store, rotate, and retrieve secrets such as RDS database credentials programmatically at runtime, so the application never hardcodes them in source code. Option C is correct because Elastic Beanstalk environment properties let you inject configuration values, including database credentials, as environment variables into the application without embedding them in the codebase. Option B is wrong because storing credentials in a configuration file inside the application source code is exactly the insecure practice the developer wants to avoid. Option D is wrong because an encrypted file on an EC2 instance still requires managing and distributing the file and its encryption key, which is less secure and operationally fragile than a managed secrets service or environment properties. Option E is wrong because an S3 bucket with a public read policy would expose the credentials to anyone, creating a severe security breach.

Answer

Store the credentials in a configuration file within the application source code.

Answer

Store the credentials in an encrypted file on an EC2 instance.

Answer

Store the credentials in an S3 bucket with a public read policy.

Question 3

A company has a production application running on Amazon ECS with Fargate. The application consists of a front-end service and a backend service that processes orders. The backend service consumes messages from an Amazon SQS queue and writes order records to an Amazon DynamoDB table. Recently, during a marketing campaign, traffic increased significantly, causing the backend service to fall behind processing messages. The SQS queue depth grew to over 100,000 messages, and some orders were not processed in time, leading to customer complaints. The operations team noticed that the ECS service's CPU utilization never exceeded 60%, and memory utilization was around 50%. The service is configured with a desired count of 2 tasks and a target tracking scaling policy based on average CPU utilization. The DynamoDB table has on-demand capacity mode. After analyzing the logs, the development team found that each message processing takes about 2 seconds, but the backend service has a bottleneck: it makes an HTTP call to a third-party API that sometimes takes up to 10 seconds to respond. The team wants to optimize the architecture to handle traffic spikes better without over-provisioning resources.

Which solution is MOST effective?

Accepted Answer

Refactor the backend service to send the order processing request to a separate SQS queue and have a dedicated set of tasks poll that queue to make the HTTP call. This decouples the main processing from the slow API call.. The correct solution is Option B. The bottleneck is the third-party API call that can take up to 10 seconds. By refactoring the backend service to send the order processing request to a separate SQS queue and having a dedicated set of tasks poll that queue, the main processing is decoupled from the slow API call. This allows the ECS tasks to quickly process messages from the original queue and offload the HTTP call, increasing overall throughput without over-provisioning. Option A (increasing batch size) would not help because the bottleneck is the API latency, not the polling efficiency. Option C (increasing desired count and scaling on queue depth) could help but is over-provisioning and less efficient than decoupling. Option D (scaling on memory) does not address the root cause of the API call latency.

Answer

Increase the batch size of messages polled from SQS to 20 to process more messages per task.

Answer

Increase the desired count of the ECS service to 10 tasks and set a target tracking scaling policy based on SQS queue depth.

Answer

Change the scaling policy to use memory utilization instead of CPU, since CPU is underutilized.

Question 4

A developer deployed a new Lambda function that processes messages from an SQS queue. The function runs correctly for small workloads but starts timing out after 15 seconds when traffic increases. The function has a reserved concurrency of 10 and a timeout of 30 seconds. CloudWatch logs show occasional throttling errors (429). What is the MOST likely cause?

Accepted Answer

The reserved concurrency is too low.. The reserved concurrency of 10 is too low because it caps the maximum number of concurrent Lambda invocations, and when SQS traffic increases, Lambda throttles invocations with 429 errors. With only 10 concurrent executions, messages pile up in the queue and each invocation may wait longer for downstream resources, leading to timeouts. Increasing reserved concurrency allows more parallel processing, reducing queue backlog and preventing the 15-second timeouts observed under load.

Answer

The function memory is too low.

Answer

The SQS batch size is too large.

Answer

The function timeout is too low.

Question 5

A developer is troubleshooting an AWS Lambda function that writes to an S3 bucket. The function is failing with an 'AccessDenied' error. The Lambda execution role has the following policy. What is the likely issue?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Accepted Answer

The bucket uses SSE-KMS encryption, and the role lacks kms:Decrypt permission.. The policy in the Lambda execution role grants s3:PutObject and s3:GetObject permissions on objects in the bucket (objects matching `my-bucket/*`). However, if the S3 bucket uses SSE-KMS encryption, the Lambda function must also have KMS permissions. Specifically, to write (PutObject) an object encrypted with SSE-KMS, the execution role requires the `kms:GenerateDataKey` permission. Without this, the PutObject call will fail with an AccessDenied error. Option D correctly identifies the missing KMS permission when updated to kms:GenerateDataKey.

Option A is incorrect because the resource ARN `arn:aws:s3:::my-bucket/*` is correct for object-level operations like PutObject and GetObject.

Option B is incorrect because having extra permissions like GetObject does not cause an AccessDenied error for PutObject.

Option C is incorrect because s3:ListBucket is a bucket-level permission and is not required for PutObject operations.

Answer

The resource ARN should be 'arn:aws:s3:::my-bucket' instead of 'my-bucket/*'.

Answer

The action should be 's3:PutObject' only, not 's3:GetObject'.

Answer

The role is missing s3:ListBucket permission.

Question 6

A developer is troubleshooting a slow-running Amazon RDS for PostgreSQL instance. Which TWO metrics should the developer examine in Amazon CloudWatch to identify a possible resource bottleneck?

Accepted Answer

CPUUtilization. CPUUtilization (A) is correct because it directly shows the percentage of CPU capacity consumed by the DB instance; sustained high values indicate the database is CPU-bound and a compute bottleneck exists. ReadIOPS and WriteIOPS combined with a high Average Queue Depth (B) are correct because elevated disk I/O operations paired with a growing queue depth reveal that storage throughput/latency is the limiting factor, a classic I/O bottleneck. FreeableMemory (C) is not the best indicator here since it reflects available RAM but does not by itself pinpoint a resource bottleneck for a slow instance. NetworkThroughput (D) measures bytes transferred and is not typically the primary bottleneck metric for a slow RDS instance. DatabaseConnections (E) shows the count of active connections, which can indicate connection pressure but does not directly identify a CPU or I/O resource bottleneck.

Answer

FreeableMemory

Answer

NetworkThroughput

Answer

DatabaseConnections

Question 7

A company is using Amazon S3 to store log files. The logs are rarely accessed after 30 days but must be retained for 7 years for compliance. Which THREE actions should the company take to optimize storage costs?

Accepted Answer

Use S3 Lifecycle policy to transition objects to S3 Glacier after 1 year.. Option E is correct because the logs are rarely accessed after 30 days, so transitioning them to S3 Standard-IA at that point matches the access pattern and reduces storage cost while keeping the data immediately retrievable. Option C is correct because after 1 year the logs are even colder, and moving them to S3 Glacier provides a much lower-cost archival storage class suitable for long-term retention. Option D is correct because the compliance requirement is 7 years, so an S3 Lifecycle expiration rule that deletes the objects after 7 years prevents indefinite storage charges once the retention obligation ends. Option A is wrong because deleting objects after 30 days would violate the 7-year compliance retention requirement. Option B is wrong because S3 One Zone-IA stores data in a single Availability Zone and is not appropriate for compliance logs that require durability and resilience, and it also ignores the need to transition to colder, cheaper archival tiers over time.

Answer

Use S3 Lifecycle policy to delete objects after 30 days.

Answer

Store objects in S3 One Zone-IA from the start.

Question 8

A developer is debugging an AWS Lambda function that is invoked by an Amazon S3 event notification. The function sometimes fails with a 'ResourceNotFoundException' when trying to access a DynamoDB table. The function's execution role has the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "dynamodb:*",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"
    }
  ]
}

What are TWO possible causes for this intermittent failure?

Accepted Answer

The DynamoDB table is in a different AWS Region than the Lambda function.. A typo in the DynamoDB table name (C) would cause the Lambda function to request a resource that does not match the IAM policy's Resource ARN. IAM authorization happens before DynamoDB processes the request, so the function would receive AccessDeniedException, not ResourceNotFoundException. The table being in a different region (E) can cause ResourceNotFoundException only if the DynamoDB client uses the default region (the Lambda region), looking for a table that does not exist there. The IAM policy allows the request to the ARN in the Lambda region, but DynamoDB does not find the table, resulting in ResourceNotFoundException. Therefore, only E is a valid cause. The question asks for two causes, but only one option is correct.

Answer

The Lambda function's execution role is not attached to the function.

Answer

The Lambda function is inside a VPC without a DynamoDB VPC endpoint.

Answer

The DynamoDB table name contains a typo in the Lambda code.

Answer

The IAM policy does not include the 'dynamodb:GetItem' action specifically.

Question 9

A developer is using Amazon ElastiCache to improve the performance of a read-heavy web application. After implementing caching, some users see stale data. Which TWO strategies can the developer use to ensure cache coherence?

Accepted Answer

Use write-through caching.. Option B (write-through caching) is correct because it updates the cache at the same time as the underlying data store, so reads always hit a cache entry that reflects the latest write and stale data is avoided. Option E (lazy loading with a short TTL) is correct because lazy loading populates the cache on demand and a short TTL bounds how long any cached value can remain stale, so outdated entries expire quickly and are refreshed from the source. Option A is not marked correct: a TTL alone only limits staleness after expiry and does not guarantee coherence while the entry is still valid. Option C is not marked correct: invalidating on update is a valid coherence technique, but it is not one of the two answers marked correct here. Option D is not marked correct: database read replicas address read scaling and replication lag, not ElastiCache cache coherence.

Answer

Set a suitable TTL for cached data.

Answer

Invalidate the cache entry when the underlying data is updated.

Answer

Use read replicas of the database to serve read traffic.

Question 10

A company runs a production web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application uses a custom health check endpoint /health that returns HTTP 200 when the application is healthy. Recently, the operations team noticed that the Auto Scaling group is repeatedly launching and terminating instances (flapping) even though the application is stable. The health check grace period is set to 300 seconds. The ALB health check interval is 30 seconds, unhealthy threshold is 2, and healthy threshold is 5. The Auto Scaling group uses the ELB health check type. The application logs show no errors. What is the MOST likely cause of the flapping?

Accepted Answer

The healthy threshold is set too high, causing instances to be considered unhealthy for too long.. The most likely cause is that the healthy threshold is set too high. With a healthy threshold of 5 and a health check interval of 30 seconds, an instance must pass 5 consecutive health checks before being marked healthy, which takes at least 2.5 minutes (150 seconds). However, the health check grace period is 300 seconds (5 minutes), meaning the instance is only given 5 minutes to become healthy. If the application starts quickly but takes some time to respond to health checks (e.g., cold start), the instance might not pass 5 checks within the grace period. After the grace period, if the instance hasn't passed 5 checks, the ALB marks it unhealthy, causing the Auto Scaling group to terminate and launch new instances. This flapping continues because new instances also fail to become healthy in time. Lowering the healthy threshold would allow instances to be considered healthy sooner, reducing flapping.

Answer

The EC2 instance type is not suitable for the application, causing slow responses.

Answer

The ALB is experiencing high latency and marking instances unhealthy.

Answer

The Auto Scaling group has a target tracking scaling policy that is too aggressive.

Question 11

An application running on Amazon ECS with Fargate is unable to connect to the internet. The task definition does not have any network configuration specified. What is the MOST likely cause?

Accepted Answer

The task is not assigned a public IP address and is in a private subnet.. Fargate tasks using the awsvpc network mode do not have public IP addresses by default unless explicitly assigned. If the task is placed in a private subnet, it needs a route to a NAT gateway to access the internet. Without a public IP and without a NAT gateway, the task cannot connect to the internet. Option A (security group not allowing outbound) is incorrect because security groups are stateful and allow outbound traffic by default; the issue is routing, not security groups. Option C (service discovery) is unrelated to internet access; it is for service-to-service DNS within the VPC. Option D (no internet gateway) is incorrect because even with an internet gateway, a private subnet instance still needs a NAT gateway; the internet gateway alone does not provide internet access to private subnet resources.

Answer

The security group associated with the task does not allow outbound traffic.

Answer

The ECS service discovery is not configured.

Answer

The VPC does not have an internet gateway attached.

Question 12

A company runs a containerized web application on Amazon ECS with Fargate launch type. The application experiences intermittent HTTP 503 errors. The ECS service auto-scales based on CPU, but the errors persist. What is the most likely cause and solution?

Accepted Answer

The ALB health check interval is too short; increase the health check interval.. The ALB health check interval is too short, causing the load balancer to mark tasks as unhealthy before they have time to respond, leading to 503 errors. Increasing the health check interval gives the application more time to respond, reducing false unhealthy statuses. This is a common issue when health checks are too aggressive for the application's startup or response time.

Answer

The CPU threshold is too low; increase the target value to 80%.

Answer

The ALB idle timeout is too low; increase it to 300 seconds.

Answer

The cluster does not have enough EC2 instances; add more instances.

Question 13

A developer is using AWS CodePipeline to deploy a serverless application. The pipeline has a CodeBuild stage that runs unit tests. Recently, the build stage started failing with a 'ResourceNotFoundException: The specified bucket does not exist' error. The buildspec.yml references an artifact bucket. What is the most likely cause?

Accepted Answer

The artifact bucket was deleted or is in a different AWS Region.. CodePipeline uses a separate artifact bucket owned by the service, which must be in the same region. Option B is wrong because build logs do not affect artifact storage. Option C is wrong because IAM permissions would give AccessDenied, not ResourceNotFound. Option D is wrong because the default artifact bucket is managed by CodePipeline, not CodeBuild.

Answer

The IAM service role for CodeBuild does not have s3:GetObject on the bucket.

Answer

The CodeBuild project does not have permission to write to CloudWatch Logs.

Answer

The buildspec.yml uses an invalid bucket name syntax.

Question 14

A developer is troubleshooting an AWS Lambda function that is failing with a timeout error. The function has a 15-minute timeout and processes messages from an Amazon SQS queue. Which TWO actions should the developer take to resolve the issue?

Accepted Answer

Increase the SQS batch size in the Lambda event source mapping.. The Lambda function is timing out while processing messages from SQS. With a 15-minute timeout, the issue is likely that the function cannot process messages quickly enough. Increasing the SQS batch size (option C) allows the function to receive more messages in each invocation, reducing the number of invocations and overhead. Using SQS batch operations in the function (option E) enables processing multiple messages efficiently within a single invocation, increasing throughput. These two actions together help process messages faster and avoid timeouts. Option A (reducing visibility timeout) would cause more retries and worsen the issue. Option B (increasing timeout to 15 minutes) is already at 15 minutes, so not a fix. Option D (dead-letter queue) handles failed messages after retries, but does not resolve the timeout issue.

Answer

Reduce the SQS visibility timeout.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Configure a dead-letter queue for the SQS queue.

Question 15

A company's application runs on Amazon EC2 instances in an Auto Scaling group. The application experiences intermittent failures, and the developer suspects the application is not properly handling termination notifications. Which TWO steps should the developer take to diagnose the issue?

Accepted Answer

Configure a CloudWatch Events rule to capture Auto Scaling termination events.. Option B is correct because Amazon CloudWatch Events (now Amazon EventBridge) can match Auto Scaling lifecycle events such as EC2 Instance-terminate Lifecycle Action, allowing the developer to observe whether termination notifications are being emitted and captured. Option D is correct because adding a lifecycle hook to the Auto Scaling group puts instances into a Terminating:Wait state, which pauses termination and gives the application time to receive and handle the termination notification, making it possible to diagnose whether the handling logic works. Option A is not appropriate because detailed monitoring only increases the granularity of EC2 metrics to one-minute intervals and does not capture termination notifications or application behavior. Option C is not appropriate because the CloudWatch Logs agent ships application logs but does not specifically diagnose Auto Scaling termination notification handling. Option E is not appropriate because an Elastic Load Balancer performs health checks and routes traffic, but it does not replace instances automatically or help diagnose termination notification handling.

Answer

Enable detailed monitoring on the Auto Scaling group.

Answer

Install the CloudWatch Logs agent on the instances to capture application logs.

Answer

Use an Elastic Load Balancer to replace instances automatically.