DVA-C02 Troubleshooting and Optimization Practice Test 5 — 15 Questions

Question 1

A developer is deploying a new version of a Lambda function and wants to roll back immediately if errors are detected. Which deployment strategy should the developer use?

Accepted Answer

Use AWS CodeDeploy with a canary deployment configuration. Canary deployments allow shifting a small percentage of traffic to the new version and monitoring before full rollout. Option B is wrong because rolling updates are for EC2 instances, not Lambda functions. Option C is wrong because linear deployments shift traffic in increments but do not have automatic rollback. Option D is wrong because immutable updates replace all instances and do not support gradual traffic shifting.

Answer

Use an EC2 rolling update strategy

Answer

Use AWS CodeDeploy with a linear deployment configuration

Answer

Use an immutable update strategy

Question 2

A development team is using AWS CodeCommit as a source repository and CodeBuild for build automation. They want to trigger a build automatically whenever a pull request is created or updated in the repository. Which configuration should they use?

Accepted Answer

Use Amazon EventBridge to capture CodeCommit events and trigger CodeBuild. CodeCommit integrates with Amazon EventBridge (formerly CloudWatch Events) to emit events when pull requests are created or updated. These events can be used to trigger a CodeBuild build directly, without needing an intermediate service like CodePipeline. Option A is incorrect because S3 event notifications are for S3 buckets, not CodeCommit repositories. Option B is incorrect because webhooks are a feature of external Git providers (e.g., GitHub, Bitbucket); CodeCommit does not support webhooks but instead uses EventBridge for event-driven triggers. Option D, using CodePipeline to poll CodeCommit, is a valid but less direct approach; EventBridge is the simpler and recommended method for triggering builds on pull request events.

Answer

Configure an S3 event notification on the repository

Answer

Configure a webhook in CodeCommit to trigger CodeBuild

Answer

Create a CodePipeline that polls CodeCommit for changes

Question 3

An application uses an Auto Scaling group with a launch configuration that includes a user data script to configure instances. After a scaling event, new instances launch but fail to register with the target group. The existing instances continue to work. What should the developer do to resolve this issue?

Accepted Answer

Create a new launch configuration with corrected user data and update the Auto Scaling group. Launch configurations are immutable, so you cannot modify an existing one. To fix the user data, you must create a new launch configuration with the corrected user data and then update the Auto Scaling group to use the new launch configuration. Existing instances launched with the old configuration are unaffected; new instances will use the corrected user data. Option B correctly describes this process. Option A is wrong because you cannot modify an existing launch configuration. Option C is wrong because the Auto Scaling group does not automatically use the latest version; you must explicitly update it. Option D is wrong because deleting and recreating the group is unnecessary and would disrupt all instances.

Answer

Modify the existing launch configuration with the correct user data

Answer

Update the Auto Scaling group to use the latest launch configuration version

Answer

Delete and recreate the Auto Scaling group

Question 4

A developer is troubleshooting an AWS Lambda function that is failing with an 'AccessDenied' error when trying to write to an S3 bucket. The function's execution role has the following policy. What is the most likely cause of the failure? (Policy: { 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Action': 's3:PutObject', 'Resource': 'arn:aws:s3:::my-bucket/*' } ] })

Accepted Answer

The S3 bucket has a bucket policy that denies the Lambda role access.. The IAM policy attached to the Lambda execution role correctly allows s3:PutObject on the bucket's objects. However, when a bucket policy explicitly denies access to the role or does not grant the required permissions, it takes precedence over the identity-based policy, resulting in an 'AccessDenied' error. Therefore, the most likely cause is a restrictive bucket policy.

Answer

The resource ARN does not include the bucket itself; it only includes objects

Answer

The action 's3:PutObject' is not allowed for Lambda execution roles

Answer

The action 's3:PutObject' is not sufficient; need 's3:*'

Question 5

A company runs a web application on EC2 instances in an Auto Scaling group. The application needs to store session state. The architecture must be highly available and scalable. Which solution should the developer choose?

Accepted Answer

Use Amazon ElastiCache for Redis to store session state. ElastiCache (Redis) provides a highly available, low-latency, and scalable session store that is external to the instances. Option A is wrong because sticky sessions (session affinity) can cause uneven load and are not highly available if an instance fails. Option B is wrong because storing session data in an S3 bucket would be slow and not designed for low-latency session access. Option D is wrong because storing session data on the local instance's ephemeral storage is not durable and cannot be shared across instances.

Answer

Use sticky sessions on the Application Load Balancer

Answer

Store session data in an S3 bucket

Answer

Store session data in the instance's ephemeral storage

Question 6

A developer is using AWS CodePipeline to automate a multi-stage pipeline. The pipeline includes a manual approval step before deploying to production. The developer wants to receive an email notification when the pipeline reaches the approval step. Which service should the developer use?

Accepted Answer

Use Amazon CloudWatch Events to detect the pipeline state change and trigger an SNS notification. CloudWatch Events (now part of Amazon EventBridge) can detect pipeline state changes such as a manual approval step entering a 'waiting' state. You can create a rule that matches this event and targets an Amazon SNS topic to send an email notification. Option A is incorrect because CodePipeline does not have an 'Email' action built-in. Option B is incorrect because CloudWatch Logs is used for monitoring log data, not for triggering notifications directly. Option C is incorrect because while Amazon SES can send emails, it is not directly integrated with CodePipeline; the recommended approach is to use CloudWatch Events with SNS for notifications.

Answer

Configure CodePipeline to send an email using the 'Email' action

Answer

Use Amazon CloudWatch Logs to monitor the pipeline logs and trigger an alarm

Answer

Use Amazon Simple Email Service (SES) to send an email from the pipeline

Question 7

Which TWO services can be used to store and retrieve application configuration data in AWS? (Choose 2)

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store (Option C) is a managed service specifically designed to store and retrieve application configuration data, such as database connection strings, passwords, and license keys. It integrates with AWS KMS for encryption and supports hierarchical parameter paths, making it ideal for configuration management without custom code.

Answer

AWS CloudTrail

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon DynamoDB

Question 8

Which THREE factors should a developer consider when designing a stateless application on AWS? (Choose 3)

Accepted Answer

Avoid storing data on the local file system of the instances. A stateless application should not store session state locally, so option A is correct. Session state should be stored in an external shared datastore like ElastiCache (option B) or a shared database like DynamoDB (option E). Storing state in instance memory (C) or using sticky sessions (D) would introduce statefulness, which is not desired in a stateless architecture.

Answer

Store session state in the instance memory for low latency

Answer

Use sticky sessions on the load balancer to maintain session affinity

Question 9

The above IAM policy is attached to an IAM user. The user is unable to invoke the Lambda function 'my-function'. What is the most likely reason?

Accepted Answer

The Lambda function does not have a resource-based policy allowing the user to invoke it. The most likely reason is that the Lambda function 'my-function' does not have a resource-based policy that grants the user permission to invoke it. IAM policies grant permissions to the user, but Lambda functions also require a resource-based policy (function policy) to allow invocation by a specific principal. Without that, the invoke will be denied even if the IAM policy allows it. Option A is correct. Option B is incorrect because the resource ARN in the IAM policy does not need a version or alias to allow invocation; it can refer to the function itself. Option C is incorrect because 'lambda:InvokeFunction' is sufficient; 'lambda:*' is not required. Option D is incorrect because the policy version is relevant only if the policy syntax is wrong, but the question indicates the policy is attached and the only issue is the missing resource-based policy.

Answer

The resource ARN is missing the function version or alias

Answer

The action 'lambda:InvokeFunction' is not sufficient; need 'lambda:*'

Answer

The policy version is incorrect

Question 10

A developer ran the above CLI command to describe an EC2 instance. The instance is running but the developer cannot connect to it via SSH. Which additional step should the developer take to troubleshoot the connectivity issue?

Accepted Answer

Check the security group rules associated with the instance. Security group rules control inbound traffic to the instance. If the security group does not allow SSH (port 22) from the developer's IP, the connection will fail even if the instance is running and has a public IP. The describe-instances command output includes security group names and IDs, allowing the developer to verify the rules. Option A is wrong because a valid AMI does not guarantee network connectivity. Option B is wrong because the instance may have a public IP but still be unreachable if the security group blocks SSH. Option C is wrong because instance status checks indicate the OS and instance health, not network-level access.

Answer

Check the AMI ID to ensure it is a valid Linux AMI

Answer

Check the instance's network interfaces for a public IP

Answer

Check the instance status checks in the EC2 console

Question 11

The above CloudWatch alarm is configured for an EC2 instance. The alarm state is 'INSUFFICIENT_DATA' and has been for 2 days. Which of the following is the most likely cause?

Accepted Answer

The EC2 instance is stopped. The INSUFFICIENT_DATA state indicates that CloudWatch has not received any metric data for the alarm. For basic EC2 metrics like CPUUtilization, data is automatically sent to CloudWatch every 5 minutes by default. If the instance is stopped, no data is sent, leading to INSUFFICIENT_DATA. Option C is incorrect because the CloudWatch agent is not needed for basic metrics; it is required only for custom or OS-level metrics. Therefore, the most likely cause is that the EC2 instance is stopped.

Answer

The alarm period and evaluation periods are misconfigured

Answer

The CloudWatch agent is not installed on the EC2 instance

Answer

The threshold is set too high for the metric

Question 12

A developer is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The build fails with the error 'no basic authentication credentials'. The build project has an IAM role with the AmazonEC2ContainerRegistryPowerUser policy. What is the most likely cause?

Accepted Answer

The buildspec does not include the pre_build step to authenticate with ECR.. The IAM role provides permissions, but CodeBuild must authenticate with ECR before pushing. The buildspec needs a pre_build step that runs `aws ecr get-login-password --region | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com`. Without this authentication step, Docker cannot push, resulting in 'no basic authentication credentials'. Therefore, the correct answer is D.

Answer

The build project is not configured to use a VPC that can reach ECR.

Answer

The build environment does not have Docker installed.

Answer

The IAM role does not have sufficient permissions to push to ECR.

Question 13

An application running on Amazon EC2 generates logs that need to be streamed to Amazon CloudWatch Logs. The developer installs and configures the CloudWatch agent. However, logs are not appearing in the log group. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an IAM role with CloudWatch Logs write permissions.. The CloudWatch agent requires an IAM role with permissions to write logs. Without the proper permissions, the agent cannot send logs. Option A is correct. Option B is wrong because the agent can be installed on EC2. Option C is wrong because the log group is created automatically if not existing. Option D is wrong because the agent is configured via a config file, not the console.

Answer

The CloudWatch agent cannot be installed on Amazon Linux 2.

Answer

The CloudWatch agent must be configured from the AWS Management Console.

Answer

The log group must be created manually before the agent can send logs.

Question 14

A developer has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is experiencing high invocation errors. The developer sees that the function's reserved concurrency is set to 0. What is the impact?

Accepted Answer

The function is not receiving any invocations because it has no concurrency available.. Reserved concurrency of 0 means the function has no available concurrency units, so it cannot be invoked. As a result, the function never runs, and messages remain in the SQS queue or are sent to a dead-letter queue if configured. Option D is correct because the function is not receiving any invocations. Option A is incorrect because the function never runs, so memory is not relevant. Option B is incorrect because throttling is not the issue; the function is simply not invoked. Option C is incorrect because the code never executes to produce an error.

Answer

The function's memory is insufficient, causing out-of-memory errors.

Answer

The function is throttled due to high request volume.

Answer

The function's code has an error causing it to fail.

Question 15

A developer is using Amazon API Gateway with a Lambda integration. The API returns a 502 Bad Gateway error. The developer checks the Lambda function logs and finds no invocations. What is the most likely cause?

Accepted Answer

The API Gateway does not have permission to invoke the Lambda function.. An HTTP 500 Internal Server Error from API Gateway with a Lambda integration, combined with a total absence of Lambda invocation logs, typically indicates that API Gateway lacks the necessary resource-based policy permissions (`lambda:InvokeFunction`) to invoke the Lambda function. Because API Gateway cannot trigger the function at all, no logs are generated in CloudWatch, and API Gateway returns a 500 error.

If the Lambda function were invoked but returned an invalid response, timed out, or ran out of memory, API Gateway would return a 502 Bad Gateway or 504 Gateway Timeout error, and invocation logs would be present.

Answer

The Lambda function is returning a non-JSON response.

Answer

The Lambda function is timing out due to a long-running operation.

Answer

The Lambda function's memory is insufficient, causing it to crash.