DVA-C02 Troubleshooting and Optimization Practice Test 8 — 15 Questions

Question 1

A company runs a containerized web application on Amazon ECS with Fargate launch type. The application experiences intermittent HTTP 503 errors. The ECS service auto-scales based on CPU, but the errors persist. What is the most likely cause and solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ALB health check interval is too short; increase the health check interval.. HTTP 503 errors from an ALB typically indicate that the targets are failing health checks. In an ECS Fargate service with auto-scaling, new tasks may require time to initialize and pass health checks. If the health check interval is too short, tasks may be considered unhealthy before they are ready, leading to 503 errors. Increasing the health check interval gives tasks more time to become healthy. Option B is incorrect because increasing the CPU threshold would reduce the frequency of scaling, potentially worsening the errors. Option C is incorrect because the idle timeout relates to 504 (gateway timeout) errors, not 503. Option D is incorrect because Fargate does not use EC2 instances; it runs tasks without managing underlying infrastructure.

Answer

The CPU threshold is too low; increase the target value to 80%.

Answer

The ALB idle timeout is too low; increase it to 300 seconds.

Answer

The cluster does not have enough EC2 instances; add more instances.

Question 2

A developer is debugging an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function fails with an 'AccessDenied' error when trying to read an object from the same bucket. What should the developer check first?

Accepted Answer

Review the Lambda function's execution role for s3:GetObject permission.. The Lambda execution role must have s3:GetObject permission for the bucket. Option A is wrong because S3 Block Public Access does not affect Lambda access. Option B is wrong because encryption settings do not cause AccessDenied if permissions are correct. Option C is wrong because bucket versioning is not related to access.

Answer

Check if S3 bucket versioning is enabled.

Answer

Verify that the S3 bucket uses server-side encryption with AWS KMS.

Answer

Ensure the S3 bucket is not blocked by S3 Block Public Access.

Question 3

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing increased latency. The developer suspects the ALB is the bottleneck. How can the developer confirm this using CloudWatch metrics?

Accepted Answer

Monitor the TargetResponseTime metric and compare it to the client's perspective.. To determine if the ALB or the backend targets are causing the latency, the developer should monitor the 'TargetResponseTime' metric. This metric measures the time elapsed (in seconds) from when the request leaves the ALB until a response from the target is received. If 'TargetResponseTime' is low but the client-side latency is high, the bottleneck lies within the ALB itself or the network. If 'TargetResponseTime' is high, the bottleneck is the backend EC2 instances. 'SurgeQueueLength' is a Classic Load Balancer metric and is not available on ALBs.

Answer

Monitor the HealthyHostCount metric and ensure it is equal to the number of instances.

Answer

Monitor the SurgeQueueLength metric and look for sustained high values.

Answer

Monitor the RequestCount metric and check if it exceeds the ALB's limit.

Question 4

A developer is using AWS CodePipeline to deploy a serverless application. The pipeline has a CodeBuild stage that runs unit tests. Recently, the build stage started failing with a 'ResourceNotFoundException: The specified bucket does not exist' error. The buildspec.yml references an artifact bucket. What is the most likely cause?

Accepted Answer

The artifact bucket was deleted or is in a different AWS Region.. CodePipeline uses a separate artifact bucket owned by the service, which must be in the same region. Option B is wrong because build logs do not affect artifact storage. Option C is wrong because IAM permissions would give AccessDenied, not ResourceNotFound. Option D is wrong because the default artifact bucket is managed by CodePipeline, not CodeBuild.

Answer

The IAM service role for CodeBuild does not have s3:GetObject on the bucket.

Answer

The CodeBuild project does not have permission to write to CloudWatch Logs.

Answer

The buildspec.yml uses an invalid bucket name syntax.

Question 5

A developer optimized an Amazon S3 bucket for high request rates. The bucket receives over 5,000 PUT requests per second. Recently, some requests are failing with a 503 Slow Down error. What is the most likely cause and how should the developer fix it?

Accepted Answer

Add a random prefix to the object keys to distribute across partitions.. S3 returns 503 when request rates exceed partition limits. Prefix randomization spreads requests across partitions. Option A is wrong because 503 is not due to permissions. Option B is wrong because 503 is not a quota limit exceeded error (that would be 400). Option C is wrong because multipart upload is for large objects, not rate limits.

Answer

Use multipart upload for all objects to improve throughput.

Answer

The request rate exceeds the account-level PUT quota; request a quota increase.

Answer

The bucket policy is too permissive; restrict access to prevent abuse.

Question 6

A developer is troubleshooting an AWS Lambda function that is failing with a timeout error. The function has a 15-minute timeout and processes messages from an Amazon SQS queue. Which TWO actions should the developer take to resolve the issue?

Accepted Answer

Increase the SQS batch size in the Lambda event source mapping.. The Lambda function is timing out while processing messages from SQS. With a 15-minute timeout, the issue is likely that the function cannot process messages quickly enough. Increasing the SQS batch size (option C) allows the function to receive more messages in each invocation, reducing the number of invocations and overhead. Using SQS batch operations in the function (option E) enables processing multiple messages efficiently within a single invocation, increasing throughput. These two actions together help process messages faster and avoid timeouts. Option A (reducing visibility timeout) would cause more retries and worsen the issue. Option B (increasing timeout to 15 minutes) is already at 15 minutes, so not a fix. Option D (dead-letter queue) handles failed messages after retries, but does not resolve the timeout issue.

Answer

Reduce the SQS visibility timeout.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Configure a dead-letter queue for the SQS queue.

Question 7

A developer is optimizing an Amazon S3 bucket that stores millions of small objects. The application frequently lists objects with prefix-based queries. Which THREE strategies should the developer implement to improve performance?

Accepted Answer

Use Amazon S3 Inventory to generate a daily list of objects and query that list.. To optimize prefix-based queries and listing performance for millions of small objects in Amazon S3:

1. **Amazon S3 Inventory + Athena (Option A):** S3 Inventory provides a daily or weekly list of your objects, which can be queried using Athena. This avoids expensive and slow real-time `ListObjects` API calls.
2. **DynamoDB Metadata Index (Option B):** Storing object metadata in DynamoDB allows you to perform fast, low-latency queries on prefixes and attributes without ever calling S3 list APIs.
3. **Combine Small Objects (Option E):** Having millions of small objects is an S3 anti-pattern that degrades listing and retrieval performance. Combining them into larger files (like Parquet) reduces the object count and improves performance.

**Why other options are incorrect:**
- **Option C:** Moving objects to Glacier Deep Archive does not improve listing performance; archived objects still appear in S3 listings unless they are deleted or moved to a different bucket/prefix.
- **Option D:** S3 API limits (like ListObjects TPS) are hard limits and cannot be increased by requesting a quota increase.

Answer

Move infrequently accessed objects to Amazon S3 Glacier Deep Archive.

Answer

Increase the TPS limit for ListObjects requests by requesting a quota increase.

Question 8

A developer invoked a Lambda function and saw the above output. What is the root cause of the error?

Accepted Answer

The function code expects a property that is missing from the event payload.. The error 'Cannot read property 'length' of undefined' indicates that the code tries to access the 'length' property of an undefined object, meaning the event payload lacks an expected property. Therefore, Option B is correct. Option A is incorrect because permission to access the event payload is not the issue; the function can access the event but expects a specific property. Option C is incorrect because if the handler name were wrong, the function would not start at all. Option D is incorrect because there is no timeout error; the function ran and encountered a runtime error.

Answer

The Lambda function lacks permission to access the event payload.

Answer

The Lambda function's handler name is incorrect.

Answer

The Lambda function timed out.

Question 9

A developer attached the above IAM policy to an AWS Lambda function that writes encrypted objects to an S3 bucket. The function fails with an 'AccessDenied' error when putting objects. What is the most likely reason?

Accepted Answer

The policy does not include s3:PutObjectAcl permission.. The Lambda function fails with AccessDenied when putting objects, likely because the IAM policy does not include the s3:PutObjectAcl action. When writing objects with specific ACLs (e.g., bucket policy requires certain ACLs), the PutObjectAcl permission is necessary. Option A is correct because the policy lacks this permission. Option B is incorrect because the policy does include a statement for the S3 bucket (the Resource includes the bucket ARN for s3:PutObject) but it's missing s3:PutObjectAcl. Option C is incorrect because s3:GetObject does not conflict with s3:PutObject; it's just unnecessary. Option D is incorrect because the error is an S3 AccessDenied, not a KMS-related issue; KMS permissions are separate.

Answer

The policy is missing a statement for the S3 bucket itself (not the objects).

Answer

The policy allows s3:GetObject, which is unnecessary and conflicts with PutObject.

Answer

The KMS key policy does not allow the Lambda function to decrypt.

Question 10

A developer deployed the above AWS SAM template. Messages are not being processed; they end up in the DeadLetterQueue after 3 receives. The Lambda function timeout is 30 seconds. What is the most likely cause?

Accepted Answer

The SQS visibility timeout is equal to the Lambda function timeout.. To make the question self-contained without requiring an external YAML template, the stem has been rephrased to describe the scenario directly. AWS recommends setting the SQS visibility timeout to at least 6 times the Lambda function timeout. If they are equal (e.g., both 30 seconds), messages can become visible again before the Lambda function finishes processing and deletes them, leading to duplicate processing and eventually moving them to the DLQ.

Answer

The maxReceiveCount is too low; increase it to 5.

Answer

The batch size is too high, causing the function to timeout.

Answer

The Lambda function does not have permission to poll the SQS queue.

Question 11

A developer is troubleshooting a Lambda function that times out sporadically. The function reads from an S3 bucket and processes CSV files. Which of the following is the MOST likely cause?

Accepted Answer

S3 GET request throttling during high traffic.. Sporadic timeouts in Lambda processing S3 objects are most likely due to S3 GET request throttling under high traffic. S3 has limits on request rates (e.g., 5,500 GET requests per second per prefix). When many concurrent requests exceed this limit, throttling occurs, causing delays and timeouts. Cold starts cause initial latency but not sporadic timeouts. Insufficient memory would cause failures or out-of-memory errors, not timeouts. VPC configuration issues would cause consistent timeouts, not sporadic.

Answer

VPC configuration missing a NAT gateway.

Answer

Cold starts due to low invocation frequency.

Answer

Insufficient memory allocated to the Lambda function.

Question 12

A developer notices that an application is generating duplicate entries in a DynamoDB table. The application uses a Lambda function triggered by an SQS queue. Messages are processed with at-least-once delivery. Which design change will reduce duplicates?

Accepted Answer

Implement idempotent processing by checking a condition expression in DynamoDB PutItem.. SQS provides at-least-once delivery, so duplicates are possible. Making the Lambda function idempotent using a unique message deduplication ID (e.g., using the message ID as a condition in DynamoDB) prevents duplicates.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Use a FIFO SQS queue with content-based deduplication.

Answer

Use DynamoDB Transactions to ensure atomic writes.

Question 13

A developer is troubleshooting a slow-running query in Amazon RDS for MySQL. The query is used by a reporting dashboard. Which AWS service should the developer use to identify the bottleneck?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights provides a detailed analysis of database performance, including wait events and SQL query performance, helping identify bottlenecks.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 14

A company uses an S3 bucket to store sensitive documents. The bucket policy allows access only from a specific VPC endpoint. However, a developer in the same VPC is unable to access the bucket from an EC2 instance. What is the MOST likely cause?

Accepted Answer

The EC2 instance is routing traffic to S3 through the internet instead of the VPC endpoint.. S3 bucket policies that restrict access to a specific VPC endpoint require that requests originate from that endpoint. The EC2 instance must route S3 traffic through the VPC endpoint. If the instance has a public IP and routes directly to S3, the request won't go through the endpoint.

Answer

The S3 bucket policy requires encryption in transit, which is not configured.

Answer

The VPC endpoint policy does not grant access to the developer's IAM role.

Answer

The EC2 instance does not have an IAM role assigned.

Question 15

A developer is using AWS X-Ray to trace requests through a microservices application. One of the services, Service B, is not appearing in the trace map. What is the MOST likely reason?

Accepted Answer

Service B is not instrumented with the X-Ray SDK.. For X-Ray to trace requests across services, each service must be instrumented with the X-Ray SDK. If Service B is not instrumented, it won't send trace data, and it won't appear in the trace map.

Answer

Service B is using HTTP/2, which is not supported by X-Ray.

Answer

Service B is running in a different AWS region.

Answer

The X-Ray sampling rate is set too low.