DVA-C02 Troubleshooting and Optimization Practice Test 7 — 15 Questions

Question 1

An application running on Amazon ECS Fargate is experiencing intermittent connection timeouts when calling an external API. The task has a public IP and a security group that allows outbound HTTPS. What is the most likely cause?

Accepted Answer

The task is running in a private subnet without a NAT gateway.. Option D is correct because ECS Fargate tasks running in a private subnet do not have direct internet access. Without a NAT gateway, outbound traffic to the external API is routed to the subnet’s route table, which lacks an internet gateway target, causing connection timeouts. The task’s public IP assignment is irrelevant in a private subnet, as the subnet itself has no route to the internet.

Answer

The ECS service is not configured to auto-assign public IP.

Answer

The task's security group does not allow inbound traffic.

Answer

The security group outbound rules are misconfigured.

Question 2

A developer is deploying a serverless application using AWS CloudFormation. The stack creation fails with the error 'The following resource(s) failed to create: [MyLambdaFunction]'. The developer checks the CloudWatch logs but finds no logs for the Lambda function. What is the most likely reason?

Accepted Answer

The Lambda function's IAM role does not have permission to write to CloudWatch Logs.. Option C is correct because the error indicates the Lambda function resource failed to create, and the absence of CloudWatch logs suggests the function was created but lacked the necessary IAM permissions to write logs. Without the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` permissions, Lambda cannot write to CloudWatch Logs, so no logs appear even if the function is invoked. This is a common misconfiguration when deploying Lambda via CloudFormation without attaching the proper IAM policy.

Answer

The Lambda function code has a syntax error that prevents creation.

Answer

The Lambda function was never invoked.

Answer

The CloudFormation template has a syntax error.

Question 3

A company runs a Node.js application on AWS Elastic Beanstalk. The application is experiencing high latency. The developer suspects the database queries are slow. Which step should the developer take first to diagnose the issue?

Accepted Answer

Enable enhanced health reporting and monitor CloudWatch metrics for database connection time.. The first step is to enable enhanced health reporting and use CloudWatch metrics to monitor database query performance. Option B is wrong because increasing instance size is a solution, not diagnosis. Option C is wrong because you need to identify the slow queries first. Option D is wrong because switching to DynamoDB is a major architectural change.

Answer

Migrate the database to Amazon DynamoDB for better performance.

Answer

Add database indexing to improve query performance.

Answer

Increase the instance size to improve performance.

Question 4

A developer is using Amazon S3 Transfer Acceleration to upload a large file. The upload is slower than expected. Which metric should the developer check to determine if Transfer Acceleration is providing a benefit?

Accepted Answer

CloudWatch metric 'TotalRequestLatency' for the S3 bucket.. TotalRequestLatency measures the time taken for a complete S3 request, including the time to send the request to the S3 endpoint and receive the response. For S3 Transfer Acceleration, this metric reflects the end-to-end latency improvement achieved by routing traffic through AWS edge locations and the optimized network path. A lower TotalRequestLatency compared to a non-accelerated upload indicates that Transfer Acceleration is providing a benefit.

Answer

CloudWatch metric 'Requests' for the S3 bucket.

Answer

CloudWatch metric 'BytesDownloaded' for the S3 bucket.

Answer

CloudWatch metric 'FirstByteLatency' for the S3 bucket.

Question 5

A developer is using AWS CloudFront to serve static content. Users in some geographic regions report slow load times. Which CloudFront feature can the developer use to reduce latency for these users?

Accepted Answer

Change the CloudFront price class to include all edge locations.. CloudFront has a global network of edge locations. If latency is high in certain regions, the developer can add additional edge locations by using Origin Shield or ensuring the price class includes those regions. However, CloudFront automatically uses all edge locations; the issue may be that the origin is far. Adding more edge locations (via price class) helps. But the simplest is to use a regional edge cache or Origin Shield. Option A is wrong because S3 Transfer Acceleration is for uploads to S3, not CloudFront distribution. Option B is wrong because Lambda@Edge runs at edge, but it adds compute, not reduce latency for static content. Option C is wrong because multiple origins are for different content, not latency. Option D is correct: enabling additional edge locations via price class (e.g., Price Class All) ensures all edge locations serve content.

Answer

Create multiple origins in different regions.

Answer

Enable S3 Transfer Acceleration on the origin S3 bucket.

Answer

Use Lambda@Edge to optimize content delivery.

Question 6

A developer is troubleshooting an AWS Lambda function that is triggered by an Amazon SQS queue. The function processes messages but occasionally fails. The failed messages are not being sent to the dead-letter queue (DLQ). What is the most likely reason?

Accepted Answer

The Lambda function does not have a dead-letter queue configured.. For Lambda with SQS, a DLQ can be configured on the Lambda function or on the SQS source. If the Lambda function's DLQ is not configured, messages that fail after the maximum retries are discarded. The SQS queue's own DLQ (redrive policy) applies only if the message is not processed after the maxReceiveCount. But Lambda's DLQ is separate. Option A is wrong because the SQS queue's DLQ is for when messages are not deleted after processing; Lambda deletes messages on success. Option B is wrong because the Lambda function's failure handling does not automatically send to DLQ unless configured. Option C is wrong because the Lambda function's reserved concurrency does not affect DLQ. Option D is correct: the Lambda function's DLQ must be explicitly configured.

Answer

The Lambda function's execution role does not have permission to send messages to the DLQ.

Answer

The SQS queue's redrive policy is not configured.

Answer

The Lambda function's reserved concurrency is set to 0.

Question 7

A developer is using Amazon API Gateway with a Lambda authorizer to control access to APIs. The authorizer is failing with a 500 error. The Lambda function logs show 'User: arn:aws:iam::123456789012:role/MyLambdaRole is not authorized to perform: sts:AssumeRole'. What is the most likely cause?

Accepted Answer

The Lambda function's execution role does not have sts:AssumeRole permission for the target role.. The Lambda function's execution role needs permission to call sts:AssumeRole for the authorizer's role? Actually, the error indicates that the Lambda function's role is trying to assume another role (perhaps the authorizer's role) but is not allowed. In API Gateway Lambda authorizer, the Lambda function is invoked directly by API Gateway; the function does not need to assume a role unless it calls other services. The error may be from within the Lambda code trying to assume a role. Option A is wrong because invoke permission is for API Gateway to invoke Lambda, not for Lambda to assume role. Option B is wrong because the Lambda authorizer does not need to assume a role by default. Option C is correct: the Lambda function's code is attempting to assume an IAM role (maybe to call another service) but the function's execution role lacks sts:AssumeRole permission for that role. Option D is wrong because the Lambda function's resource-based policy is for cross-account access, not for assuming roles.

Answer

The Lambda authorizer is not returning a valid policy.

Answer

The Lambda function's resource-based policy is missing.

Answer

The API Gateway does not have permission to invoke the Lambda function.

Question 8

Which TWO actions can help reduce latency for a web application hosted on EC2 instances behind an Application Load Balancer? (Select TWO.)

Accepted Answer

Use Amazon CloudFront as a content delivery network.. Enabling HTTP/2 on the ALB reduces latency by multiplexing requests. Using a Content Delivery Network (CloudFront) caches content at edge locations, reducing latency for users. Option B is wrong because increasing instance size may not reduce latency, especially if the bottleneck is network or I/O. Option C is wrong because multiple subnets increase availability, not latency. Option E is wrong because disabling keep-alive increases latency by requiring new connections.

Answer

Increase the EC2 instance size to a larger type.

Answer

Disable keep-alive connections on the ALB.

Answer

Use multiple Availability Zones for the ALB.

Question 9

A developer is investigating why an AWS Lambda function that processes Kinesis records is experiencing high latency. Which THREE factors could contribute to this? (Select THREE.)

Accepted Answer

Low number of shards in the Kinesis stream.. High batch size can cause longer processing time per invocation. Insufficient memory slows execution. A low Kinesis shard count can cause throttling and retries, increasing latency. Option B is wrong because higher concurrency (within limits) reduces latency, not increases. Option E is wrong because Lambda@Edge is for CloudFront, not Kinesis.

Answer

High concurrency limit for the Lambda function.

Answer

Using Lambda@Edge to process the records.

Question 10

Which TWO approaches can be used to optimize costs for an Amazon DynamoDB table with predictable read/write patterns? (Select TWO.)

Accepted Answer

Use provisioned capacity with auto scaling.. Using provisioned capacity with auto scaling adjusts capacity based on usage, avoiding over-provisioning. DynamoDB Accelerator (DAX) reduces read costs by caching reads. Option A is wrong because on-demand is more expensive for predictable workloads. Option C is wrong because global tables increase costs. Option D is wrong because increasing read capacity units costs more.

Answer

Increase the read capacity units to avoid throttling.

Answer

Use DynamoDB global tables for multi-region replication.

Answer

Use on-demand capacity mode.

Question 11

The developer invokes a Lambda function using the AWS CLI and gets the output shown. What is the most likely cause of the error?

Accepted Answer

The event payload does not contain the expected data.. The error 'Cannot read property 'x' of undefined' indicates that the code is trying to access a property on an undefined object. This is a runtime error in the function code, likely due to the event payload not having the expected structure. Option A is wrong because the function returned a 200 status code, meaning it was invoked successfully but the code threw an error. Option B is wrong because the error is in the code logic, not syntax (syntax errors would prevent invocation). Option C is wrong because the execution role permissions affect access to other AWS services, not code errors. Option D is correct: the payload does not contain the expected property, causing the code to fail.

Answer

The Lambda function code has a syntax error.

Answer

The Lambda function's execution role lacks permissions.

Answer

The Lambda function timed out.

Question 12

A developer attached the IAM policy above to an IAM user. The user reports being unable to list objects in the bucket 'my-bucket' using the AWS CLI command 'aws s3 ls s3://my-bucket/'. What is the most likely reason?

Accepted Answer

The IAM policy does not include the s3:GetBucketLocation action.. The `aws s3 ls s3://my-bucket/` command requires the `s3:GetBucketLocation` permission to determine the bucket's region before listing its contents. Without this action, the CLI fails with an error like 'An error occurred (AccessDenied) when calling the GetBucketLocation operation', even if `s3:ListBucket` is granted. Option D correctly identifies this missing permission as the root cause.

Answer

The IAM policy does not allow the s3:GetObject action on the bucket.

Answer

The IAM policy resource for s3:ListBucket should include the bucket and objects.

Answer

The IAM policy is missing the s3:ListAllMyBuckets action.

Question 13

A developer is deploying a CloudFormation stack and sees the event above. What should the developer do to fix the error?

Accepted Answer

Change the runtime to a supported version like nodejs18.x.. The error indicates that the Node.js 12.x runtime is deprecated. The developer should update the runtime to a supported version, such as nodejs18.x, in the CloudFormation template and redeploy. Option A is wrong because the timeout is not the issue. Option B is wrong because the Lambda function code may be fine; the runtime is the problem. Option C is wrong because adding permissions won't fix the unsupported runtime.

Answer

Update the Lambda function code to use a different programming language.

Answer

Increase the Lambda function timeout in the template.

Answer

Add permissions to the Lambda function's execution role.

Question 14

A developer deployed a new version of a Lambda function that processes S3 events. After deployment, some S3 events are not being processed. The CloudWatch Logs show no errors. What is the most likely cause?

Accepted Answer

The S3 bucket's event notification still points to the old Lambda function.. Option B is correct because after deploying a new version of a Lambda function, the S3 bucket's event notification configuration still references the Amazon Resource Name (ARN) of the old Lambda function version or the function without a qualifier. S3 event notifications are configured to invoke a specific Lambda function ARN, and if the ARN does not point to the new version (e.g., by using an alias or the $LATEST qualifier), events will continue to be sent to the old version, which may not be processing them. Since CloudWatch Logs show no errors, the old version is likely not being invoked or is not logging, confirming the mismatch.

Answer

The Lambda function has a syntax error.

Answer

The Lambda function alias is not pointing to the new version.

Answer

The S3 events are being throttled by Lambda.

Question 15

An application uses an Application Load Balancer (ALB) with a target group of EC2 instances. Users report intermittent HTTP 503 errors. The ALB access logs show that the error occurs when the request rate exceeds 10,000 requests per second. What is the most likely cause?

Accepted Answer

The ALB is exceeding its connection limit.. Option A is correct because ALB has a default limit of 10,000 new connections per second (which may be lower depending on region) and exceeding it causes 503 errors. Option B is wrong because connection draining is a graceful shutdown, not causing errors. Option C is wrong because the instances are healthy. Option D is wrong because the issue is not SSL negotiation.

Answer

The EC2 instances are failing health checks.

Answer

The SSL certificate is expiring.

Answer

The target group's connection draining is too short.