DVA-C02 Troubleshooting and Optimization Practice Test 6 — 15 Questions

Question 1

A Lambda function is timing out after 3 seconds when processing an S3 event. The function reads a file from S3 and writes to DynamoDB. The timeout is set to 5 seconds. What is the MOST likely cause of the timeout?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The function is attached to a VPC without a NAT gateway, causing network timeouts when accessing S3 and DynamoDB.. The correct answer is A: the function is attached to a VPC without a NAT gateway, causing network timeouts when accessing S3 and DynamoDB. When a Lambda function is placed in a VPC, it loses the default internet access and can only reach resources within that VPC unless a NAT gateway (or VPC endpoints) is configured; S3 and DynamoDB are public AWS services, so calls to them hang and the function times out at its 5-second limit. Option B is less likely because DynamoDB throttling returns ProvisionedThroughputExceededException errors rather than silent network timeouts, and it would typically surface as retries/errors, not a hard 3-second hang. Option C is incorrect because low memory reduces CPU and slows execution but does not cause network-level timeouts to AWS services. Option D is incorrect because reserved concurrency throttling produces ThrottlingException/429 errors at invocation, not in-function timeouts while reading S3 and writing DynamoDB.

Answer

DynamoDB write capacity is insufficient, causing write requests to be throttled.

Answer

The function's memory allocation is too low, causing CPU throttling.

Answer

The function is hitting the reserved concurrency limit and being throttled.

Question 2

A developer is using AWS CodeBuild to build a Java application. The build succeeds locally but fails on CodeBuild with a 'Cannot find symbol' error for a class that is in a dependency JAR. What is the MOST likely cause?

Accepted Answer

The dependency cache is not enabled in CodeBuild, so dependencies are not available.. CodeBuild by default does not include cached dependencies; each build downloads dependencies from scratch unless a cache is configured. The local build works because Maven/Gradle caches dependencies locally. Option A (build timing out before dependencies are fully downloaded) would cause an incomplete download, but CodeBuild typically fails on download errors, not missing symbols after successful download. Option B (insufficient compute memory) might cause out-of-memory errors during compilation, not a 'Cannot find symbol' error. Option D (incorrect buildspec syntax) would cause a build failure earlier, not a compilation error. Therefore, the most likely cause is that dependency caching is not enabled, leading to missing cached dependencies.

Answer

The build is timing out before dependencies are fully downloaded.

Answer

The CodeBuild compute type does not have enough memory to compile the project.

Answer

The buildspec file has incorrect syntax causing the build to skip dependency resolution.

Question 3

A developer is using AWS CloudFormation to deploy a stack. The stack creation fails with the error 'API: iam:CreateRole User: arn:aws:iam::123456789012:user/DevUser is not authorized to perform: iam:CreateRole'. The developer is using an IAM user with AdministratorAccess policy attached. What is the MOST likely cause of this error?

Accepted Answer

The CloudFormation stack is using a service role that does not have iam:CreateRole permission.. The error indicates that the IAM user 'DevUser' is not authorized to perform iam:CreateRole, despite having an AdministratorAccess policy attached. The most likely cause is that the CloudFormation stack is using a service role, and that service role does not have the iam:CreateRole permission. CloudFormation uses the service role's permissions, not the user's, when creating resources. If the service role lacks the required permission, the operation fails. Option A is incorrect because hitting the IAM role limit would produce a 'limit exceeded' error. Option C is incorrect because IAM is a global service and is supported in all regions. Option D is incorrect because the AdministratorAccess policy is an AWS managed policy that includes full IAM permissions; if it were modified, it would no longer be AdministratorAccess.

Answer

The account has reached the IAM role limit.

Answer

The CloudFormation stack is being created in a region where IAM is not supported.

Answer

The AdministratorAccess policy has been modified to remove IAM permissions.

Question 4

A developer deployed a new version of a Lambda function using an alias that points to the new version. However, the function continues to invoke the old version. What is the MOST likely cause?

Accepted Answer

The alias was not updated to point to the new version after deployment.. If the alias is not updated to point to the new version, it still invokes the old version. Option A is incorrect because IAM execution role permissions do not affect which version is invoked; they affect whether the function can be invoked at all. Option C is incorrect because reserved concurrency set to 0 would cause throttle errors, not invocation of old code. Option D is incorrect because a different function name would result in a resource not found error, not invoking old code.

Answer

The IAM execution role for the Lambda function does not have permission to invoke the new version.

Answer

The Lambda function's reserved concurrency is set to 0, preventing new invocations.

Answer

The function name in the invocation request is different from the deployed function.

Question 5

A company uses Amazon S3 to store sensitive data. A developer needs to ensure that all objects uploaded to a specific S3 bucket are encrypted at rest. Which approach should the developer take?

Accepted Answer

Add a bucket policy that denies PutObject if the object is not encrypted.. A bucket policy that denies PutObject unless the request includes server-side encryption (using a condition on s3:x-amz-server-side-encryption or s3:x-amz-server-side-encryption-aws-kms-key-id) enforces encryption at rest for all uploads to the bucket. This is a preventive control that rejects unencrypted PUT requests at the bucket level, regardless of which IAM principal is uploading.

Answer

Use pre-signed URLs with server-side encryption parameters.

Answer

Attach an IAM policy to all users requiring them to include the x-amz-server-side-encryption header.

Answer

Enable default encryption on the bucket using SSE-S3.

Question 6

A developer is investigating why an Amazon API Gateway REST API is returning 504 errors during peak traffic. The API integrates with a Lambda function. Which TWO factors are MOST likely causing the 504 errors? (Choose TWO.)

Accepted Answer

The Lambda function is hitting its reserved concurrency limit and being throttled.. Options A and D are correct. Option A: If the Lambda function hits its reserved concurrency limit and is throttled, API Gateway receives a 429 from Lambda and returns a 504 error to the client. Option D: If the Lambda function's configured timeout is too short, it may timeout before the API Gateway integration timeout (29 seconds), causing a 504. Option B is incorrect because a full cache does not cause 504 errors. Option C is incorrect because AWS WAF blocking would result in a 403 Forbidden, not a 504. Option E is incorrect because exceeding API Gateway account-level throttling limits would cause 429 Too Many Requests, not 504.

Answer

The API Gateway cache is full and cannot store responses.

Answer

The AWS WAF is blocking the request.

Answer

The API Gateway account-level throttling limits are exceeded.

Question 7

A developer is optimizing an application that uses Amazon DynamoDB. The application reads items by primary key and also performs queries on a Global Secondary Index (GSI). The developer notices that some queries on the GSI are slow. Which TWO actions would improve the performance of GSI queries? (Choose TWO.)

Accepted Answer

Use a more distributed GSI partition key to avoid hot partitions.. Option A is correct because using a more distributed GSI partition key avoids hot partitions, which prevents throttling and improves query performance.

Option C is correct because in DynamoDB, Global Secondary Indexes (GSIs) have their own provisioned read and write capacity units (RCUs and WCUs) separate from the base table. If GSI queries are slow due to throttling, increasing the read capacity of the GSI will resolve the issue.

Option B is incorrect because ensuring the GSI key attribute exists on all items makes them present in the index (avoiding a sparse index), which is a functional requirement for data visibility rather than a performance optimization. In fact, sparse indexes can sometimes improve performance by reducing the index size.

Option D is incorrect because GSIs only support eventually consistent reads.

Option E is incorrect because increasing the write capacity of the base table does not improve GSI read performance.

Answer

Ensure that the GSI key attribute exists on all items that need to be queried.

Answer

Use strongly consistent reads on the GSI.

Answer

Increase the write capacity of the DynamoDB table.

Question 8

A company is using Amazon ElastiCache for Redis to improve the performance of a high-traffic web application. Recently, the application has been experiencing increased latency. The developer suspects that cache misses are causing the application to read from the database more frequently. Which THREE metrics should the developer examine in Amazon CloudWatch to troubleshoot this issue? (Choose THREE.)

Accepted Answer

CacheMisses. To troubleshoot increased latency due to cache misses, the developer should examine CacheMisses (A) to directly see the number of cache misses, Evictions (B) to identify keys removed due to memory pressure that could cause further misses, and CurrConnections (D) to check for connection bottlenecks that might slow down cache access. SwapUsage (C) indicates memory swapping, which is not directly related to cache efficiency, and CPUUtilization (E) is not a primary metric for cache hit ratio issues.

Answer

SwapUsage

Answer

CPUUtilization

Question 9

A developer is deploying a web application on Amazon ECS with Fargate. The application needs to store session state. Which THREE options are suitable for storing session state in a distributed environment? (Choose THREE.)

Accepted Answer

Amazon RDS for MySQL. Amazon RDS for MySQL (B) is correct because a relational database with a shared, network-accessible endpoint lets all Fargate tasks read and write the same session records, so sessions persist regardless of which task handles a request. Amazon DynamoDB (D) is correct because it is a fully managed, low-latency key-value store ideal for session tables keyed by session ID, with automatic scaling and TTL support for expiring sessions. Amazon ElastiCache for Redis (E) is correct because Redis provides an in-memory, sub-millisecond data store commonly used for session state, and its replication and persistence features make sessions available across multiple tasks. Amazon S3 (A) is not suitable because it is object storage with high per-request latency and eventual consistency characteristics, not designed for frequent small session reads/writes. Local ephemeral storage on the Fargate task (C) is not suitable because it is tied to a single task's lifecycle and is not shared, so sessions are lost when the task stops or another task handles the request.

Answer

Amazon S3

Answer

Local ephemeral storage on the Fargate task

Question 10

A developer has attached the IAM policy shown in the exhibit to a user. The user reports that they can upload and delete objects in the bucket 'my-bucket', but cannot list the objects in the bucket. What is the MOST likely reason?

Accepted Answer

The bucket has a bucket policy that denies s3:ListBucket.. The most likely reason is that a bucket policy explicitly denies s3:ListBucket, which overrides any allow in the IAM policy. In AWS, an explicit deny in any policy (identity-based or resource-based) takes precedence over any allow, so the user can still perform actions not denied (upload/delete) but cannot list.

Answer

The IAM policy is missing the s3:GetObject permission for listing.

Answer

The user is using the ListObjectsV2 API call instead of ListObjects.

Answer

The bucket is in a different region than the default region configured in the AWS CLI.

Question 11

A developer is optimizing an S3 bucket that stores large CSV files for analytics. The files are accessed frequently for the first 30 days, then rarely accessed. After 90 days, the data must be retained for compliance but accessed infrequently. What is the MOST cost-effective lifecycle policy?

Accepted Answer

Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 90 days.. The most cost-effective policy is to transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 90 days. This aligns with the access pattern: frequent access for 30 days, then infrequent access, and finally long-term retention with rare access. S3 Glacier Deep Archive is the lowest-cost storage class for archival data, suitable for compliance retention.

Answer

Use S3 Intelligent-Tiering to automatically move data between access tiers.

Answer

Transition to S3 One Zone-IA after 30 days, then delete after 90 days.

Answer

Transition to S3 Glacier Flexible Retrieval after 30 days, then to S3 Glacier Deep Archive after 90 days.

Question 12

A company has a DynamoDB table with a global secondary index (GSI) for querying. The write capacity is provisioned at 1000 WCU, and the GSI has 500 WCU. During a traffic spike, writes to the table are throttled, but the GSI is not throttled. What is the MOST likely cause?

Accepted Answer

The total write traffic to the table exceeds 1000 WCU.. The table is throttling due to write traffic exceeding its provisioned write capacity of 1000 WCU. The global secondary index (GSI) has its own write capacity of 500 WCU, and if the writes to the GSI are within that limit, the GSI will not be throttled. Option A is incorrect because DynamoDB adaptive capacity automatically adjusts throughput to handle traffic spikes, but it does not reduce the table's provisioned capacity; it helps prevent throttling. Option B is incorrect because a hot partition would cause throttling on specific partitions, which would likely also affect the GSI since it uses the same partition key; moreover, the scenario indicates general throttling, not just on a partition. Option D is incorrect because the GSI is not throttled, so its write capacity is not the issue.

Answer

DynamoDB adaptive capacity is reducing the table's write capacity.

Answer

A hot partition in the table is exceeding its partition-level write limits.

Answer

The GSI is throttling writes because its write capacity is insufficient.

Question 13

A company is using AWS Elastic Beanstalk for a Node.js application. The environment's health is 'Severe' and the logs show 'ELB health check target http://:80/ is not responding'. What is the MOST likely cause?

Accepted Answer

The application is listening on a different port than the health check expects.. The health check target 'http://:80/' indicates that the load balancer is trying to connect to port 80 on the EC2 instances, but the application is not listening on that port (for example, if a Node.js developer hardcoded port 3000 instead of using the environment's PORT variable). Option A is incorrect because if the application were not deployed, the error would typically be a 503 or 'no healthy instances' rather than a specific health check target not responding. Option C is incorrect because Elastic Beanstalk automatically configures and manages the security groups to allow traffic between the load balancer and the EC2 instances, making an application port misconfiguration much more likely. Option D is incorrect because the load balancer is configured to listen on port 80, as shown by the health check target, so the issue is on the instance side.

Answer

The application is not deployed to the EC2 instances.

Answer

The security group for the EC2 instances is blocking traffic on port 80.

Answer

The load balancer is not configured to listen on port 80.

Question 14

A company has a Lambda function that processes messages from an SQS queue. The function sometimes fails to process a message, and the message is not retried. The developer wants to ensure that failed messages are retried at least once. What should the developer do?

Accepted Answer

Configure the SQS queue's redrive policy with a maxReceiveCount of 2 and a DLQ.. Configuring the SQS queue's redrive policy with a maxReceiveCount of 2 and a DLQ ensures that messages failing processing are retried (at least once) before being moved to the dead-letter queue. Lambda polls SQS and, on function error, the message becomes visible again after the visibility timeout, allowing retries up to maxReceiveCount. This directly satisfies the requirement for at-least-once retry.

Answer

Configure a dead-letter queue (DLQ) for the SQS queue.

Answer

Set the Lambda function's retry attempts to 0 in the event source mapping.

Answer

Increase the SQS queue's visibility timeout to 6 hours.

Question 15

A developer is troubleshooting a slow web application. The application uses an Application Load Balancer, EC2 instances, and an RDS database. The developer suspects the database is the bottleneck. Which TWO CloudWatch metrics should the developer examine to confirm this? (Select TWO.)

Accepted Answer

DatabaseConnections. Option A (DatabaseConnections) is correct because this RDS metric shows the number of active client connections to the database; a spike or sustained high value indicates connection pressure or connection pooling issues that can make the database the bottleneck. Option E (CPUUtilization) is correct because high RDS CPU utilization directly signals that the database engine is saturated processing queries, which is a classic indicator of a database bottleneck. Option B (RequestCount) is an Application Load Balancer metric that reflects incoming request volume, not database load, so it cannot confirm the database is the bottleneck. Option C (NetworkIn) measures inbound network traffic and, while it may rise with load, it is not a specific indicator of database processing bottlenecks. Option D (ReadIOPS and WriteIOPS) is a valid RDS storage metric, but it is not one of the two marked correct answers here; the question asks for the two metrics that best confirm the database bottleneck, and the marked answers are DatabaseConnections and CPUUtilization.

Answer

RequestCount

Answer

NetworkIn

Answer

ReadIOPS and WriteIOPS