DVA-C02 Troubleshooting and Optimization Practice Test 7 — 15 Questions

Question 1

A developer is optimizing costs for an AWS account. The account has multiple EC2 instances running different workloads. Some instances are used for development and are only needed during business hours. Which THREE actions can the developer take to reduce costs? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Purchase Reserved Instances for the production instances.. Options A, B, and E are correct. Purchasing Reserved Instances (A) provides significant discounts for steady-state production workloads. Using Spot Instances (B) is cost-effective for fault-tolerant workloads that can handle interruptions. AWS Instance Scheduler (E) automatically stops development instances during non-business hours, reducing costs. Option C is incorrect because gp3 volumes are generally more expensive than gp2 for the same performance; the cost savings from gp3 come from optimized performance, but it is not a guaranteed cost reduction. Option D is incorrect because increasing instance size typically increases costs, not reduces them.

Answer

Use EBS gp3 volumes instead of gp2 to save on storage costs.

Answer

Increase the instance size to handle peak load more efficiently.

Question 2

A developer is troubleshooting a Lambda function that processes S3 events. The function runs successfully in the AWS Management Console test but fails when triggered by actual S3 PUT events. The error logs show 'AccessDenied' when attempting to read the object from S3. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks 's3:GetObject' permission for the bucket.. When Lambda is invoked by S3, it assumes the function's execution role to call S3 APIs. If the execution role lacks s3:GetObject permission on the bucket, the function gets AccessDenied when reading the object. The console test likely succeeds because the developer's own IAM credentials (not the execution role) are used in the console test, masking the missing role permission. The fix is to attach an IAM policy granting s3:GetObject on the bucket ARN to the Lambda execution role.

Answer

The S3 bucket has versioning enabled and the event does not include the version ID.

Answer

The S3 bucket policy does not grant 's3:GetObject' to the Lambda service principal.

Answer

The Lambda function is not in the same VPC as the S3 bucket.

Question 3

A developer is deploying a new version of a Lambda function using AWS CodeDeploy. The deployment fails with a 'DeploymentLimitExceeded' error. What is the most likely cause?

Accepted Answer

The deployment group has reached the maximum number of concurrent deployments.. The 'DeploymentLimitExceeded' error in AWS CodeDeploy for Lambda occurs when the deployment group has reached its configured maximum number of concurrent deployments. CodeDeploy enforces a limit on simultaneous deployments per deployment group to protect the target resources and maintain stability. The correct fix is to wait for in-progress deployments to finish or adjust the deployment configuration limits.

Answer

The Lambda function has reached the maximum number of versions.

Answer

Another deployment is in progress for the same Lambda function.

Answer

The IAM role for CodeDeploy does not have sufficient permissions.

Question 4

A developer is troubleshooting an EC2 instance that is unreachable via SSH. The instance passed the status checks, and the security group allows SSH from the developer's IP. What should the developer check next?

Accepted Answer

The network ACL's outbound rules.. The network ACL's outbound rules should be checked next because network ACLs are stateless, meaning return traffic must be explicitly allowed in the outbound rules. Even if the security group allows SSH inbound, the network ACL must allow outbound traffic on ephemeral ports (1024-65535) for the SSH response to reach the client. Since the instance passed status checks and the security group is correct, the network ACL is the likely culprit.

Answer

The security group's outbound rules.

Answer

The route table for the subnet.

Answer

The instance's system log for kernel errors.

Question 5

A developer is trying to decrypt an S3 object using an AWS KMS key. The decryption fails with an 'AccessDenied' error. The IAM policy attached to the developer's user includes the statement in the exhibit. The KMS key policy includes the following statement:

{
  "Sid": "Enable IAM User Permissions",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:root"
  },
  "Action": "kms:*",
  "Resource": "*"
}

What is the most likely reason for the failure?

Accepted Answer

The developer's IAM policy does not include 'kms:Decrypt' permission.. For KMS decryption to succeed, both the key policy and the caller's IAM policy must allow the action (unless the key policy grants access directly to the principal). The key policy here delegates to the account root, which enables IAM policies to grant access — but the developer's IAM policy lacks kms:Decrypt, so the request is denied.

Answer

The KMS key policy does not grant access to the developer's IAM user.

Answer

The KMS key policy specifies 'kms:*' which is too broad and causes a conflict.

Answer

The developer's IAM policy uses 'Resource' with the full key ARN but the key policy requires a different format.

Question 6

A developer is using AWS CloudFormation to deploy a stack. The stack creation fails with a 'CREATE_FAILED' status for an EC2 instance resource. The event message says 'The requested configuration is currently not supported. Please check the documentation for supported configurations.' What should the developer do to resolve this issue?

Accepted Answer

Change the instance type or specify a different Availability Zone in the template.. The error 'The requested configuration is currently not supported' indicates that the specified instance type is not available in the chosen Availability Zone. To resolve this, the developer should modify the CloudFormation template to change the instance type to one that is supported in that AZ, or specify a different Availability Zone that supports the original instance type, then update the stack. Option C (change the instance type or specify a different Availability Zone) directly addresses this issue. Option A is incorrect because simply updating a parameter value without changing the instance type or AZ will not fix the unsupported configuration. Option B is irrelevant as the error is about hardware compatibility, not permissions. Option D is wrong because the AMI is not the cause; the instance type/AZ combination is unsupported regardless of the AMI.

Answer

Update the stack with a new parameter value.

Answer

Add an IAM role to the EC2 instance.

Answer

Use a different Amazon Machine Image (AMI).

Question 7

A company's API Gateway REST API is experiencing high latency. The API integrates with a Lambda function that queries an RDS database. The developer notices that the Lambda function's duration metric is low, but the API Gateway integration latency is high. What is the most likely cause?

Accepted Answer

The Lambda function is in a VPC, causing additional network hops.. When a Lambda function is configured to access resources in a VPC (like RDS), it creates elastic network interfaces (ENIs) in the VPC and routes traffic through the VPC's network. This adds network hops and can introduce latency, especially if the Lambda function is not properly configured with VPC endpoints or if the RDS instance is in a different subnet/AZ. The low Lambda duration indicates the function itself is fast, but the integration latency is high, pointing to network overhead from VPC attachment.

Answer

The Lambda function has reached the concurrency limit.

Answer

The API Gateway cache is enabled and causing a cache miss for every request.

Answer

The RDS database is in a different region than the API Gateway.

Question 8

A developer is using SQS to decouple microservices. The producer sends messages, but the consumer (an EC2 instance) does not process them. The CloudWatch metric 'ApproximateNumberOfMessagesVisible' is increasing. The consumer's IAM role has 'sqs:ReceiveMessage' and 'sqs:DeleteMessage' permissions. What is the most likely cause?

Accepted Answer

The consumer is not using long polling, so calls to ReceiveMessage return empty frequently.. The key issue is that the consumer is not using long polling. With short polling (default), `ReceiveMessage` queries only a subset of servers and may return empty even if messages exist. Enabling long polling (`WaitTimeSeconds` > 0) reduces empty responses and ensures that the consumer actually receives messages. While permissions and DLQ configuration are possible issues, the given IAM permissions are sufficient (they include `ReceiveMessage` and `DeleteMessage`), and the DLQ would only receive messages after the max receive count is exceeded, but messages remain visible. SSE-KMS encryption requires additional KMS permissions, but that would cause access denied errors, not just visible messages increasing. The increasing `ApproximateNumberOfMessagesVisible` indicates messages are not being consumed, and assuming the consumer is running, the most likely cause is that it is not effectively receiving messages due to short polling.

Answer

A dead-letter queue is configured and messages are being moved there.

Answer

The consumer does not have permission to call 'sqs:ReceiveMessage'.

Answer

The queue is encrypted with SSE, and the consumer does not have permission to use the KMS key.

Question 9

A company is using CloudFront with an S3 origin to serve static content. Users in some geographic regions experience high latency. The developer wants to optimize performance. Which THREE actions should the developer take?

Accepted Answer

Increase the TTL for the cache behavior to reduce requests to the origin.. Increasing TTL (Time to Live) reduces the number of requests to the origin, which can decrease latency for users by serving content from edge caches more often. Option B is wrong: S3 Transfer Acceleration is designed for fast uploads to S3, not for improving CloudFront delivery; it does not reduce latency for static content served via CloudFront. Option C is correct: CloudFront Origin Shield acts as a caching layer that reduces the load on the origin and can improve performance by consolidating requests. Option D is correct: configuring multiple origins and setting up origin failover can improve availability and reduce latency by routing requests to a healthy origin closer to the user. Option E is wrong: CloudFront already has a global network of edge locations; you cannot add additional edge locations yourself. The existing edge locations are sufficient; the issue is likely origin-related.

Answer

Enable S3 Transfer Acceleration for the origin bucket.

Answer

Add additional CloudFront edge locations in the affected regions.

Question 10

A developer is debugging an application that uses Amazon SQS. The application occasionally processes the same message twice. Which TWO configurations can help prevent duplicate processing?

Accepted Answer

Increase the visibility timeout to ensure messages are deleted before becoming visible again.. Option A is correct because increasing the visibility timeout keeps a message invisible to other consumers long enough for the current consumer to finish processing and delete it, preventing the message from becoming visible again and being processed a second time. Option E is correct because a FIFO queue with content-based deduplication uses a deduplication ID (or a SHA-256 hash of the message body) to suppress duplicate messages sent within the 5-minute deduplication interval, directly preventing duplicate processing. Option B is not correct because a dead-letter queue only isolates messages that repeatedly fail processing; it does not prevent duplicates. Option C is not correct because delivery delay merely postpones when a message becomes available, without stopping duplicate delivery. Option D is not correct because long polling reduces empty responses and cost, not duplicate processing.

Answer

Configure a dead-letter queue to capture duplicates.

Answer

Increase the delivery delay to defer message processing.

Answer

Enable long polling to reduce empty responses.

Question 11

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and several Lambda functions. The developer runs 'sam deploy' and the deployment succeeds. However, when the developer tests the API endpoint using curl, the request times out. The CloudWatch logs for the Lambda function show that the function is not being invoked. The API Gateway logs are not enabled. The developer checks the API Gateway console and sees that the integration type is 'AWS Service' instead of 'Lambda Function'. The developer used the following SAM template snippet:

Resources:
  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      DefinitionBody:
        swagger: 2.0
        info:
          title: My API
        paths:
          /items:
            get:
              x-amazon-apigateway-integration:
                type: aws_proxy
                uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFunction.Arn}/invocations
              responses: {}
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src
      Handler: index.handler
      Runtime: nodejs14.x
      Events:
        ApiEvent:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /items
            Method: GET

What is the most likely cause of the timeout?

Accepted Answer

The API Gateway integration type is misconfigured; the SAM template should use 'AWS::Serverless::Function' event source instead of manual Swagger integration.. The SAM template defines the API using both the 'AWS::Serverless::Api' resource with a Swagger definition inline and the 'AWS::Serverless::Function' with an Api event. This may cause a conflict or incorrect configuration. Option D is correct: the 'x-amazon-apigateway-integration' type is set to 'aws_proxy' but the URI is incorrect. However, the API Gateway integration type shown as 'AWS Service' indicates that the integration was not properly set up. The most likely cause is that the SAM template incorrectly defines the integration, leading to a misconfiguration. Option A is wrong because the timeout is not due to Lambda limits. Option B is wrong because the code is not invoked. Option C is wrong because the API is correctly set up for public access.

Answer

The API Gateway endpoint is not publicly accessible due to a resource policy.

Answer

The Lambda function's code is throwing an unhandled exception before it can log.

Answer

The Lambda function has reached the concurrency limit.

Question 12

A developer notices that an S3 bucket's 'PutObject' API calls are failing intermittently for a specific application. The application uses the AWS SDK for Java to upload files. The error message is 'RequestTimeout: Your socket connection to the server was not read from or written to within the timeout period.' The bucket is in the same region as the application. The developer checks the S3 metrics and sees no throttling errors. The application runs on EC2 instances behind an ALB. The developer suspects a network issue. What should the developer do to resolve the issue?

Accepted Answer

Increase the socket timeout in the AWS SDK configuration and ensure the network path (ALB) has a higher idle timeout.. The 'RequestTimeout' error indicates that the connection was idle for too long. Since the application runs on EC2 behind an ALB, the ALB's idle timeout may be shorter than the S3 SDK's timeout, causing the socket connection to be closed prematurely. Increasing the socket timeout in the AWS SDK configuration and ensuring the ALB has a higher idle timeout resolves the issue. Option A is incorrect because adding a bucket policy does not address network timeouts. Option B (S3 VPC endpoint) improves network reliability but does not directly resolve idle timeout mismatches. Option D (S3 Transfer Acceleration) is designed for large files over long distances and does not fix idle timeout issues.

Answer

Add a bucket policy that grants s3:PutObject to the application's IAM role.

Answer

Use an S3 VPC endpoint to improve network reliability.

Answer

Enable S3 Transfer Acceleration on the bucket and update the application to use the accelerated endpoint.

Question 13

A developer is troubleshooting a Lambda function that occasionally times out. The function makes HTTPS calls to an external API. Which configuration change is MOST likely to resolve the issue without increasing the risk of further timeouts?

Accepted Answer

Increase the function's timeout setting.. The function times out because the external HTTPS call occasionally takes longer than the configured timeout. Increasing the timeout setting gives the call enough time to complete, directly addressing the symptom without introducing new failure modes. This is the most targeted fix for intermittent timeouts on external calls.

Answer

Increase the function's memory allocation.

Answer

Decrease the function's reserved concurrency.

Answer

Change the function invocation type to synchronous.

Question 14

A developer is using Amazon API Gateway with a Lambda authorizer to protect a REST API. The authorizer is configured with a TTL of 300 seconds. After updating the IAM policy attached to the authorizer's execution role, some users still receive 403 Forbidden errors for requests that should be allowed. What is the MOST likely cause?

Accepted Answer

The authorizer's cached results are still valid, so the old policy is being applied.. Lambda authorizers cache their authorization decisions for the configured TTL (300 seconds in this case). When the underlying IAM policy attached to the authorizer's execution role is updated, the cached Allow/Deny decisions from before the change remain in effect until the TTL expires. Users whose requests were previously denied will continue to receive 403 Forbidden until the cache entry is invalidated or expires.

Answer

The Lambda authorizer function has a timeout that prevents it from evaluating the new policy.

Answer

The IAM policy update has not propagated to all regions.

Answer

The API Gateway endpoint was not redeployed after the policy change.

Question 15

A developer notices that an S3 bucket configured for static website hosting returns 403 Forbidden errors when accessed from a browser. The bucket policy allows s3:GetObject for principal "*" but only over HTTPS. What is the MOST likely reason for the error?

Accepted Answer

The request was sent over HTTP instead of HTTPS.. The bucket policy includes a condition that requires HTTPS. If the browser sends an HTTP request, the condition fails and the request is denied with a 403 error. Option A is incorrect because the policy allows anonymous access (principal "*") and does not require IAM authentication. Option B is incorrect because the policy explicitly allows s3:GetObject for anonymous principals over HTTPS. Option D is incorrect because the S3 website endpoint does support HTTPS; the issue is the condition in the policy, not the endpoint's protocol support.

Answer

The requester is not authenticated with AWS IAM.

Answer

The bucket policy denies s3:GetObject for anonymous principals.

Answer

The S3 bucket website endpoint does not support HTTPS.