DVA-C02 Troubleshooting and Optimization Practice Test 7 — 15 Questions

Question 1

A developer is working on a serverless application that uses AWS Lambda functions to process user uploads. The uploads are stored in an S3 bucket, and each upload triggers a Lambda function that resizes images and stores metadata in DynamoDB. Recently, users have reported that some images are not being resized. The developer checks the CloudWatch logs and sees that the Lambda function is invoked, but it fails with a timeout error after 15 seconds for a few large images. The function has a timeout of 15 seconds and a memory of 512 MB. The image sizes vary from 1 MB to 50 MB. The developer wants to handle large images without increasing the timeout significantly, as that would increase costs. The function is CPU-bound during image processing. Which solution should the developer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the memory allocated to the Lambda function to 3008 MB, which also increases CPU power, allowing faster processing within the same timeout.. In AWS Lambda, CPU power scales linearly with memory allocation for CPU-bound tasks. By increasing the memory to 3008 MB, the function gets more CPU, allowing it to process large images faster within the 15-second timeout, without increasing costs significantly (since Lambda pricing is based on memory and duration). Option B is incorrect because splitting images adds unnecessary complexity and may not be practical. Option C is incorrect because simply increasing the timeout does not address the CPU bottleneck; the function would still run slowly. Option D is incorrect because Step Functions does not improve processing speed; it only adds orchestration overhead.

Answer

Split the large images into smaller chunks before uploading to S3, then reassemble them after processing.

Answer

Increase the Lambda function timeout to 5 minutes to accommodate large images.

Answer

Use AWS Step Functions to orchestrate the image processing workflow, allowing longer timeouts for individual steps.

Question 2

A developer deployed a new Lambda function that processes messages from an SQS queue. The function runs correctly for small workloads but starts timing out after 15 seconds when traffic increases. The function has a reserved concurrency of 10 and a timeout of 30 seconds. CloudWatch logs show occasional throttling errors (429). What is the MOST likely cause?

Accepted Answer

The reserved concurrency is too low.. When traffic increases, the Lambda function experiences throttling errors (429) because the reserved concurrency of 10 is too low to handle the surge of concurrent invocations from SQS. Although the function timeout is set to 30 seconds, throttling causes requests to be queued, and by the time they are processed, they may exceed the Lambda timeout (15 seconds observed) and fail. Option A is incorrect because memory affects execution speed, not concurrency limits. Option C is incorrect because SQS batch size determines messages per invocation, but throttling is about concurrency, not batch size. Option D is incorrect because the timeout is already 30 seconds; the timeouts are a consequence of throttling, not an insufficient timeout value.

Answer

The function memory is too low.

Answer

The SQS batch size is too large.

Answer

The function timeout is too low.

Question 3

A developer is troubleshooting an AWS Lambda function that writes to an S3 bucket. The function is failing with an 'AccessDenied' error. The Lambda execution role has the following policy. What is the likely issue?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Accepted Answer

The bucket uses SSE-KMS encryption, and the role lacks kms:Decrypt permission.. The policy in the Lambda execution role grants s3:PutObject and s3:GetObject permissions on objects in the bucket (objects matching `my-bucket/*`). However, if the S3 bucket uses SSE-KMS encryption, the Lambda function must also have KMS permissions. Specifically, to write (PutObject) an object encrypted with SSE-KMS, the execution role requires the `kms:GenerateDataKey` permission. Without this, the PutObject call will fail with an AccessDenied error. Option D correctly identifies the missing KMS permission when updated to kms:GenerateDataKey.

Option A is incorrect because the resource ARN `arn:aws:s3:::my-bucket/*` is correct for object-level operations like PutObject and GetObject.

Option B is incorrect because having extra permissions like GetObject does not cause an AccessDenied error for PutObject.

Option C is incorrect because s3:ListBucket is a bucket-level permission and is not required for PutObject operations.

Answer

The resource ARN should be 'arn:aws:s3:::my-bucket' instead of 'my-bucket/*'.

Answer

The action should be 's3:PutObject' only, not 's3:GetObject'.

Answer

The role is missing s3:ListBucket permission.

Question 4

A company uses AWS CloudFormation to deploy a stack that includes an RDS MySQL instance. During an update, the stack fails with a 'DELETE_FAILED' status on a security group resource. The security group has a dependency on the RDS instance. What is the MOST likely cause?

Accepted Answer

The RDS instance is not fully deleted because of a deletion protection flag.. The most likely cause is that the RDS instance has deletion protection enabled, preventing it from being deleted even when CloudFormation attempts to delete it. The security group depends on the RDS instance, so if the RDS instance cannot be deleted, the security group also fails to delete, resulting in a DELETE_FAILED status. Option A correctly identifies this. Option B is incorrect because a self-referencing rule would not cause a delete failure. Option C is incorrect because manual deletion is not required; the issue is with the RDS instance. Option D is incorrect because the security group being attached to an external EC2 instance would cause a different error, not a dependency-related failure.

Answer

The security group has a rule that references itself.

Answer

The security group must be deleted manually before updating the stack.

Answer

The security group is attached to an EC2 instance outside the stack.

Question 5

A developer is debugging an AWS Lambda function that is invoked by an Amazon S3 event notification. The function sometimes fails with a 'ResourceNotFoundException' when trying to access a DynamoDB table. The function's execution role has the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "dynamodb:*",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"
    }
  ]
}

What are TWO possible causes for this intermittent failure?

Accepted Answer

The DynamoDB table is in a different AWS Region than the Lambda function.. A typo in the DynamoDB table name (C) would cause the Lambda function to request a resource that does not match the IAM policy's Resource ARN. IAM authorization happens before DynamoDB processes the request, so the function would receive AccessDeniedException, not ResourceNotFoundException. The table being in a different region (E) can cause ResourceNotFoundException only if the DynamoDB client uses the default region (the Lambda region), looking for a table that does not exist there. The IAM policy allows the request to the ARN in the Lambda region, but DynamoDB does not find the table, resulting in ResourceNotFoundException. Therefore, only E is a valid cause. The question asks for two causes, but only one option is correct.

Answer

The Lambda function's execution role is not attached to the function.

Answer

The Lambda function is inside a VPC without a DynamoDB VPC endpoint.

Answer

The DynamoDB table name contains a typo in the Lambda code.

Answer

The IAM policy does not include the 'dynamodb:GetItem' action specifically.

Question 6

A developer is using Amazon ElastiCache to improve the performance of a read-heavy web application. After implementing caching, some users see stale data. Which TWO strategies can the developer use to ensure cache coherence?

Accepted Answer

Use write-through caching.. To address stale data and ensure cache coherence in Amazon ElastiCache, developers use two primary strategies:
1. **Write-Through Caching** (Option B): This strategy writes data to both the cache and the database simultaneously. This ensures that the cache is always up-to-date with the database, preventing stale data reads.
2. **Lazy Loading with TTL** (Option E): Lazy loading (cache-aside) loads data into the cache only when there is a cache miss. To prevent stale data when the database is updated, a Time to Live (TTL) is applied to the cache keys, ensuring they expire and are refreshed after a set period.

Option A is incomplete compared to Option E, as TTL is applied as part of the lazy loading strategy. Option C (cache invalidation) is a valid concept but is not one of the standard ElastiCache strategies emphasized in the AWS Developer Associate curriculum. Option D (read replicas) helps with database scaling but does not address cache coherence.

Answer

Set a suitable TTL for cached data.

Answer

Invalidate the cache entry when the underlying data is updated.

Answer

Use read replicas of the database to serve read traffic.

Question 7

A company runs a production web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application uses a custom health check endpoint /health that returns HTTP 200 when the application is healthy. Recently, the operations team noticed that the Auto Scaling group is repeatedly launching and terminating instances (flapping) even though the application is stable. The health check grace period is set to 300 seconds. The ALB health check interval is 30 seconds, unhealthy threshold is 2, and healthy threshold is 5. The Auto Scaling group uses the ELB health check type. The application logs show no errors. What is the MOST likely cause of the flapping?

Accepted Answer

The healthy threshold is set too high, causing instances to be considered unhealthy for too long.. The most likely cause is that the healthy threshold is set too high. With a healthy threshold of 5 and a health check interval of 30 seconds, an instance must pass 5 consecutive health checks before being marked healthy, which takes at least 2.5 minutes (150 seconds). However, the health check grace period is 300 seconds (5 minutes), meaning the instance is only given 5 minutes to become healthy. If the application starts quickly but takes some time to respond to health checks (e.g., cold start), the instance might not pass 5 checks within the grace period. After the grace period, if the instance hasn't passed 5 checks, the ALB marks it unhealthy, causing the Auto Scaling group to terminate and launch new instances. This flapping continues because new instances also fail to become healthy in time. Lowering the healthy threshold would allow instances to be considered healthy sooner, reducing flapping.

Answer

The EC2 instance type is not suitable for the application, causing slow responses.

Answer

The ALB is experiencing high latency and marking instances unhealthy.

Answer

The Auto Scaling group has a target tracking scaling policy that is too aggressive.

Question 8

A developer is using AWS Lambda with a VPC configuration. The function needs to access an Amazon RDS instance in the same VPC. The function is timing out after 3 seconds. What is the MOST likely cause?

Accepted Answer

The Lambda function's security group does not allow outbound traffic to the RDS instance.. The most likely cause of the Lambda function timing out when accessing an RDS instance in the same VPC is that the Lambda function's security group does not allow outbound traffic to the RDS instance's security group. Lambda functions in a VPC require security group rules that permit outbound traffic to the database, and inbound rules on the RDS security group to allow traffic from the Lambda function. Option A is incorrect because IAM permissions like rds:Connect are not used for network connectivity; they control API actions. Option C is incorrect because an RDS proxy is not required for Lambda to connect to RDS; it's an optional feature for connection pooling. Option D is incorrect because although increasing the timeout might temporarily mask the issue, the root cause is a network connectivity problem, not the timeout value itself.

Answer

The Lambda function's execution role does not have rds:Connect permission.

Answer

The Lambda function does not have an RDS proxy configured.

Answer

The Lambda function timeout is set too low.

Question 9

An application uses an Amazon SQS queue to decouple microservices. The producer is sending messages, but the consumer is not processing them. The consumer is an Auto Scaling group of EC2 instances. The SQS queue's ApproximateNumberOfMessagesVisible metric is increasing. What is the MOST likely cause?

Accepted Answer

The consumer instances are not polling the SQS queue.. The consumer instances are not polling the SQS queue. The ApproximateNumberOfMessagesVisible metric is increasing, meaning messages are being added but not removed from the queue. This indicates the consumer is not actively polling or processing messages. Option A is incorrect because if the queue policy denied consumer access, the consumer would receive access denied errors and likely fail to receive any messages, but the visible count would not continuously increase; the producer would still send messages, but they would not be consumed. Option C is incorrect because setting the visibility timeout too low would cause messages to become visible again shortly after being received, potentially leading to duplicate processing, but the visible count would not increase monotonically over time. Option D is incorrect because a dead-letter queue is used for messages that have been repeatedly processed and failed; it does not explain why messages are not being consumed in the first place.

Answer

The SQS queue policy denies access to the consumer.

Answer

The visibility timeout is set too low.

Answer

The SQS queue has a dead-letter queue configured.

Question 10

An application running on Amazon ECS with Fargate is unable to connect to the internet. The task definition does not have any network configuration specified. What is the MOST likely cause?

Accepted Answer

The task is not assigned a public IP address and is in a private subnet.. Fargate tasks using the awsvpc network mode do not have public IP addresses by default unless explicitly assigned. If the task is placed in a private subnet, it needs a route to a NAT gateway to access the internet. Without a public IP and without a NAT gateway, the task cannot connect to the internet. Option A (security group not allowing outbound) is incorrect because security groups are stateful and allow outbound traffic by default; the issue is routing, not security groups. Option C (service discovery) is unrelated to internet access; it is for service-to-service DNS within the VPC. Option D (no internet gateway) is incorrect because even with an internet gateway, a private subnet instance still needs a NAT gateway; the internet gateway alone does not provide internet access to private subnet resources.

Answer

The security group associated with the task does not allow outbound traffic.

Answer

The ECS service discovery is not configured.

Answer

The VPC does not have an internet gateway attached.

Question 11

A developer is using Amazon CloudFront to serve static content from an S3 bucket. Users are reporting that they see outdated content. The CloudFront distribution has a default TTL of 24 hours. What is the MOST efficient way to serve updated content immediately?

Accepted Answer

Create a CloudFront invalidation for the updated objects.. Option A. Creating a CloudFront invalidation for the updated objects immediately removes the cached versions from edge locations, forcing CloudFront to fetch the new content from the S3 origin on the next request. This is the most efficient way to serve updated content without changing the URL or causing downtime. Option B (disabling the distribution) would cause downtime. Option C (updating the object key) would require users to use a new URL. Option D (changing the default TTL to 0) only affects future caching behavior and does not purge existing cached objects.

Answer

Disable and re-enable the CloudFront distribution.

Answer

Update the object key in the S3 bucket.

Answer

Change the default TTL to 0.

Question 12

A developer is troubleshooting an AWS Lambda function that is timing out. The function has a timeout of 5 seconds and is configured with 128 MB of memory. Which TWO of the following are effective ways to resolve the timeout?

Accepted Answer

Increase the memory allocation to 512 MB.. Increasing memory allocation in AWS Lambda proportionally increases CPU and network throughput, which can reduce execution time and prevent timeouts. With 128 MB, the function may be CPU-bound; raising it to 512 MB provides more compute resources, often resolving timeout issues without code changes.

Answer

Decrease the memory allocation to 64 MB.

Answer

Deploy the function inside a VPC.

Answer

Increase the function timeout to 10 seconds.

Question 13

A company has a REST API deployed on Amazon API Gateway with a Lambda integration. The API is experiencing high latency. Which TWO actions would help diagnose the issue?

Accepted Answer

Use AWS X-Ray to trace requests.. AWS X-Ray provides end-to-end tracing of requests as they travel through API Gateway and Lambda, allowing you to identify which component (e.g., Lambda cold start, downstream calls, or API Gateway itself) is causing the latency. Enabling detailed CloudWatch Logs (execution logging) for the API Gateway stage allows you to see detailed step-by-step execution logs, including the latency of the integration (Integration Latency) and the overall API Gateway latency (Latency), which helps pinpoint where the delay is occurring.

Answer

Increase the Lambda function memory.

Answer

Change the API integration type from Lambda to HTTP.

Answer

Add Amazon CloudFront in front of API Gateway.

Question 14

A developer is using an Amazon SQS queue with a Lambda function as a consumer. Messages are being sent to the queue but the Lambda function is not processing them. Which THREE of the following are possible causes?

Accepted Answer

The SQS queue policy denies access to the Lambda function.. The SQS queue policy is a resource-based policy that controls which principals (like Lambda's execution role) can perform actions on the queue. If the policy explicitly denies the Lambda function's access, the function will not be able to poll or delete messages from the queue, even if its own execution role grants those permissions.

Answer

The SQS queue has a dead-letter queue configured.

Answer

The SQS queue has a rate limit that prevents Lambda from polling.

Question 15

A developer notices that an Amazon RDS for MySQL DB instance's CPU utilization is consistently above 90% during peak hours. Which AWS service can the developer use to analyze the database queries and identify the root cause?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is the correct service for analyzing database queries and identifying the root cause of high CPU utilization. Performance Insights provides a database performance analysis feature that offers a visual dashboard and query-level metrics, enabling developers to pinpoint resource-intensive queries. AWS X-Ray is used for tracing application requests, not database queries. CloudWatch Logs is for log data storage and monitoring, not query-level analysis. Trusted Advisor provides cost and security recommendations, not database performance insights. Therefore, Performance Insights is the appropriate tool for this scenario.

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor