DVA-C02 Troubleshooting and Optimization Practice Test 5 — 15 Questions

Question 1

A developer is optimizing an Amazon S3 bucket that stores millions of small objects. The application frequently lists objects with prefix-based queries. Which THREE strategies should the developer implement to improve performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon S3 Inventory to generate a daily list of objects and query that list.. Option A is correct because Amazon S3 Inventory delivers scheduled (daily or weekly) CSV, ORC, or Parquet reports of all objects and their metadata, so the application can query that flat manifest instead of repeatedly calling the ListObjectsV2 API, which is limited to 1,000 keys per request and throttles at 5,500 GET/HEAD requests per second per prefix. Option B is correct because S3 Select and Amazon Athena let you retrieve only the needed data from objects with SQL, avoiding full object downloads and, more importantly, avoiding prefix listing entirely for content-based lookups. Option E is correct because AWS Glue crawlers can build a Data Catalog of object metadata (partitioned by prefix), enabling fast, serverless Athena/Glue queries over the bucket instead of enumerating keys with ListObjects. Option C is not relevant because moving data to Glacier Deep Archive only changes storage class and retrieval latency; it does not speed up listing or prefix queries. Option D is wrong because S3 does not offer a configurable TPS quota increase for ListObjects requests; request-rate limits are per-prefix and are scaled by spreading keys across prefixes, not by a support quota.

Answer

Move infrequently accessed objects to Amazon S3 Glacier Deep Archive.

Answer

Increase the TPS limit for ListObjects requests by requesting a quota increase.

Question 2

A developer attached the above IAM policy to an AWS Lambda function that writes encrypted objects to an S3 bucket. The function fails with an 'AccessDenied' error when putting objects. What is the most likely reason?

Accepted Answer

The policy does not include s3:PutObjectAcl permission.. The most likely cause is that the IAM policy grants s3:PutObject but omits s3:PutObjectAcl. When a Lambda function uploads an object with an ACL (or when the SDK/bucket configuration applies one), S3 requires the s3:PutObjectAcl permission in addition to s3:PutObject. Without it, the PutObject call returns AccessDenied even though the object write permission is present.

Answer

The policy is missing a statement for the S3 bucket itself (not the objects).

Answer

The policy allows s3:GetObject, which is unnecessary and conflicts with PutObject.

Answer

The KMS key policy does not allow the Lambda function to decrypt.

Question 3

A developer deployed the above AWS SAM template. Messages are not being processed; they end up in the DeadLetterQueue after 3 receives. The Lambda function timeout is 30 seconds. What is the most likely cause?

Accepted Answer

The SQS visibility timeout is equal to the Lambda function timeout.. To make the question self-contained without requiring an external YAML template, the stem has been rephrased to describe the scenario directly. AWS recommends setting the SQS visibility timeout to at least 6 times the Lambda function timeout. If they are equal (e.g., both 30 seconds), messages can become visible again before the Lambda function finishes processing and deletes them, leading to duplicate processing and eventually moving them to the DLQ.

Answer

The maxReceiveCount is too low; increase it to 5.

Answer

The batch size is too high, causing the function to timeout.

Answer

The Lambda function does not have permission to poll the SQS queue.

Question 4

A developer is troubleshooting a Lambda function that times out sporadically. The function reads from an S3 bucket and processes CSV files. Which of the following is the MOST likely cause?

Accepted Answer

S3 GET request throttling during high traffic.. S3 GET requests can be throttled when a Lambda function issues a high volume of requests, especially if the prefix partitioning is poor or the request rate exceeds the per-prefix limit (5,500 GET/HEAD requests per second per partitioned prefix). Throttling causes retries with exponential backoff, which can extend execution time and lead to sporadic timeouts. This is the most likely cause given the function reads from S3 and processes CSV files.

Answer

VPC configuration missing a NAT gateway.

Answer

Cold starts due to low invocation frequency.

Answer

Insufficient memory allocated to the Lambda function.

Question 5

A developer notices that an application is generating duplicate entries in a DynamoDB table. The application uses a Lambda function triggered by an SQS queue. Messages are processed with at-least-once delivery. Which design change will reduce duplicates?

Accepted Answer

Implement idempotent processing by checking a condition expression in DynamoDB PutItem.. SQS provides at-least-once delivery, so duplicates are possible. Making the Lambda function idempotent using a unique message deduplication ID (e.g., using the message ID as a condition in DynamoDB) prevents duplicates.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Use a FIFO SQS queue with content-based deduplication.

Answer

Use DynamoDB Transactions to ensure atomic writes.

Question 6

A company uses an S3 bucket to store sensitive documents. The bucket policy allows access only from a specific VPC endpoint. However, a developer in the same VPC is unable to access the bucket from an EC2 instance. What is the MOST likely cause?

Accepted Answer

The EC2 instance is routing traffic to S3 through the internet instead of the VPC endpoint.. S3 bucket policies that restrict access to a specific VPC endpoint require that requests originate from that endpoint. The EC2 instance must route S3 traffic through the VPC endpoint. If the instance has a public IP and routes directly to S3, the request won't go through the endpoint.

Answer

The S3 bucket policy requires encryption in transit, which is not configured.

Answer

The VPC endpoint policy does not grant access to the developer's IAM role.

Answer

The EC2 instance does not have an IAM role assigned.

Question 7

Which TWO actions should a developer take to optimize cost and performance for a Lambda function that processes real-time streaming data from Amazon Kinesis? (Choose 2.)

Accepted Answer

Enable the parallelization factor to process multiple batches concurrently per shard.. Increasing batch size reduces the number of Lambda invocations by processing more records per invocation, which lowers cost. Enabling the parallelization factor allows multiple concurrent batches per shard, improving throughput and reducing processing latency. Together, these optimize both cost and performance for Kinesis-triggered Lambda functions.

Answer

Enable provisioned concurrency to reduce cold starts.

Answer

Increase the Lambda function memory to improve processing speed.

Answer

Use a larger Kinesis shard count.

Question 8

Which TWO practices help optimize costs in Amazon DynamoDB? (Choose 2.)

Accepted Answer

Use Auto Scaling to adjust read/wapacity based on traffic.. Option B is correct because DynamoDB Auto Scaling automatically adjusts a table's or GSI's provisioned read and write capacity in response to actual traffic, so you avoid paying for idle provisioned throughput while still meeting demand. Option E is correct because on-demand capacity mode charges only for the read and write requests you actually consume, making it cost-efficient for unpredictable or spiky workloads where provisioning would risk over- or under-provisioning. Option A is wrong because purchasing reserved capacity for all tables regardless of usage wastes money on tables that do not sustain enough steady throughput to benefit from the discount. Option C is wrong because each Global Secondary Index adds its own storage and read/write capacity costs, so creating many GSIs for flexibility increases rather than optimizes cost. Option D is wrong because DAX is a caching layer that adds hourly cluster and node costs and is only cost-effective for read-heavy, latency-sensitive workloads, not something to enable for all tables.

Answer

Purchase reserved capacity for all tables regardless of usage.

Answer

Create multiple Global Secondary Indexes for query flexibility.

Answer

Enable DAX (DynamoDB Accelerator) for all tables.

Question 9

A developer attached the IAM policy above to an IAM role used by an EC2 instance. The instance is in a VPC with CIDR 10.0.0.0/16, but it cannot access objects in the S3 bucket 'example-bucket'. What is the MOST likely reason?

Accepted Answer

The condition should use 'aws:VpcSourceIp' instead of 'aws:SourceIp'.. The condition uses 'aws:SourceIp', but EC2 instances in a VPC have private IPs. For S3, the source IP that AWS sees is the public IP (if traffic goes through internet gateway) or the VPC endpoint's private IP. If the bucket policy uses 'aws:SourceIp', it compares against the source IP of the request, which for EC2 instances without a VPC endpoint is the instance's public IP (if any) or the NAT gateway's IP, not the private IP. The condition should use 'aws:VpcSourceIp' if using a VPC endpoint, or the policy should not rely on source IP from private ranges.

Answer

The policy does not allow 's3:ListBucket' action.

Answer

The IAM role does not have a trust policy.

Answer

The S3 bucket is in a different region than the EC2 instance.

Question 10

A developer tries to create a CloudFormation stack using the template above, but it fails with 'The bucket you tried to create already exists'. The developer has already deleted the bucket from the AWS Management Console. What is the MOST likely reason for the failure?

Accepted Answer

The bucket name is still globally reserved after deletion.. Even after deletion, the bucket name may still be in a 'pending deletion' state or may have been taken by another AWS account. S3 bucket names are globally unique. If the name is still reserved (e.g., recently deleted), you cannot recreate it immediately. The developer should use a different bucket name.

Answer

The CloudFormation template uses an incorrect intrinsic function.

Answer

Bucket versioning must be Disabled initially.

Answer

The developer does not have permission to create buckets in that region.

Question 11

A developer notices that an AWS Lambda function is timing out after 3 seconds. The function processes messages from an SQS queue. What is the MOST likely cause of the timeout?

Accepted Answer

The Lambda function timeout is set too low.. The most likely cause is that the Lambda function's configured timeout is too low for the work it performs. Lambda enforces a maximum execution duration per invocation (default 3 seconds, configurable up to 15 minutes), and if the function exceeds it, the invocation is terminated with a timeout error. Since the function is timing out at exactly 3 seconds, the timeout setting is the direct cause.

Answer

The SQS dead-letter queue is not configured.

Answer

The SQS queue visibility timeout is too short.

Answer

The Lambda function's reserved concurrency is set to zero.

Question 12

A company runs a Node.js application on Amazon EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB target group health checks are failing. The developer checks the EC2 instance logs and sees no application errors. What is the MOST likely cause?

Accepted Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB.. When an ALB target group's health checks fail, the ALB will return HTTP 503 (Service Unavailable) errors to clients because there are no healthy targets to route traffic to. If the developer checks the EC2 instance logs and sees no application errors (or no connection attempts at all), it indicates that the health check requests are not even reaching the application. This is typically caused by a security group misconfiguration where the EC2 instances' security group does not allow inbound traffic from the ALB's security group. Option C is incorrect because if the application returned a 5xx status code, the request would have reached the Node.js application, and the error or access attempt would be recorded in the logs.

Answer

The health check path is set to '/' but the application serves on a different path.

Answer

The EC2 instances are running out of memory.

Answer

The health check path returns a 5xx status code due to a missing dependency.

Question 13

A developer deployed a new version of an AWS Lambda function using the AWS CLI update-function-code command. The function uses environment variables to store database credentials. After the update, the function returns errors indicating it cannot connect to the database. What is the MOST likely cause?

Accepted Answer

The database credentials are encrypted but the function cannot decrypt them.. When Lambda environment variables are encrypted with a KMS customer managed key, the function's execution role must have kms:Decrypt permission on that key. After update-function-code, the function still references the same encrypted variables, but if the role lacks decrypt permissions (or the key policy was changed), the runtime cannot decrypt the values, so the database connection fails. The most likely cause is a decryption failure, not a change to the ARN or missing variables.

Answer

The function ARN changed after the update.

Answer

The environment variables were not set in the new version.

Answer

The function's IAM role was changed during the update.

Question 14

A company uses Amazon API Gateway with a Lambda integration. The API returns a 502 Bad Gateway error for some requests. The Lambda function writes logs to CloudWatch. Which steps should a developer take to troubleshoot this issue? (Select the BEST combination.)

Accepted Answer

Increase the Lambda function timeout and review the CloudWatch logs for errors.. Increasing the Lambda function timeout can resolve timeouts that cause 502 errors, and reviewing CloudWatch logs helps identify any errors in the Lambda function. Option A is wrong because enabling detailed metrics helps with monitoring but does not directly troubleshoot the 502 error. Option B is wrong because IAM permissions issues would result in a 403 Forbidden error, not a 502. Option C is wrong because API Gateway throttling returns a 429 Too Many Requests error, not a 502.

Answer

Enable API Gateway detailed metrics and create a dashboard.

Answer

Verify the IAM role permissions for API Gateway to invoke Lambda.

Answer

Check the API Gateway throttling settings and request limit.

Question 15

A developer is creating an ECS task definition using the JSON shown in the exhibit. The task fails to run with an error about insufficient memory. What is the issue?

Accepted Answer

The task memory and cpu values are specified as strings instead of integers.. The error about insufficient memory occurs because the task definition specifies 'memory' and 'cpu' as strings (e.g., '512' and '256') instead of integers. ECS requires these values to be integers. Option A is incorrect because port mapping is unrelated to memory. Option B is incorrect because network mode defaults to 'bridge' and is not required to be explicitly set. Option D is incorrect because container memory (256) is less than task memory (512), which is valid and not the cause of the failure.

Answer

The container port is not mapped to a host port.

Answer

The task definition does not specify a network mode.

Answer

The container memory is less than the task memory.