DVA-C02 Troubleshooting and Optimization Practice Test 8 — 15 Questions

Question 1

A developer is troubleshooting an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function processes new objects and writes results to a DynamoDB table. Recently, some objects are not being processed. The developer checks the CloudWatch Logs for the Lambda function and sees no errors. Which TWO actions should the developer take to investigate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the S3 bucket notification configuration to ensure it is properly set for the correct events.. Option C is correct because if the S3 bucket notification configuration is missing, disabled, or scoped to the wrong event types (e.g., only s3:ObjectCreated:Put instead of s3:ObjectCreated:*, or a mismatched prefix/suffix filter), the Lambda function will never be invoked for those objects, which perfectly explains why some objects are silently not processed with no Lambda errors in CloudWatch Logs. Option D is correct because configuring a dead-letter queue (an SQS queue or SNS topic via the Lambda DeadLetterConfig) captures asynchronous invocation failures and events that could not be delivered or processed, allowing the developer to inspect whether invocations are failing before or during execution and to see the actual failed event payloads. Option A is incorrect because DynamoDB Streams captures changes to the DynamoDB table, not the S3 object-creation events that trigger the function, so it cannot reveal why S3 notifications are not reaching Lambda. Option B is incorrect because increasing memory allocation only affects CPU and performance, and the developer already sees no errors, so a resource issue is not indicated. Option E is incorrect because the developer already reviewed CloudWatch Logs and saw no errors, and timeout messages would appear as errors in those logs, so this action would not surface new information.

Answer

Enable DynamoDB Streams on the table and process records.

Answer

Increase the Lambda function's memory allocation.

Answer

Review the Lambda function's CloudWatch Logs for timeout messages.

Question 2

An application running on Amazon ECS with Fargate is experiencing intermittent failures when connecting to an Amazon RDS database. The security group for the RDS instance allows inbound traffic from the security group attached to the ECS tasks. Which TWO additional checks should the developer perform to troubleshoot the connectivity issue?

Accepted Answer

Verify that the security group for the RDS instance has an inbound rule allowing traffic from the security group used by the ECS tasks.. Options C and D are correct. Option C is necessary because the security group for the RDS instance must have an inbound rule that references the security group attached to the ECS tasks; verifying this rule ensures that the security group configuration is correct. Option D is important because network ACLs (NACLs) are stateless and can block traffic even if security groups allow it; checking that NACLs allow inbound and outbound traffic on ephemeral ports is critical for the response traffic. Option A (VPC Flow Logs) is useful for analyzing traffic patterns but is not a primary check for intermittent connectivity; it would be used after verifying basic configurations. Option B (database credentials) is unrelated to network connectivity. Option E is incorrect because ECS tasks using Fargate in a private subnet do not require an Internet Gateway to communicate with RDS within the same VPC.

Answer

Enable VPC Flow Logs to capture dropped packets.

Answer

Check that the database credentials are correctly stored in AWS Secrets Manager.

Answer

Ensure that the ECS tasks have a route to the internet through an Internet Gateway.

Question 3

A developer attached the IAM policy above to an IAM user. The user reports that they receive an AccessDenied error when trying to upload a file to the S3 bucket using the AWS CLI without specifying any server-side encryption. What is the reason for the error?

Accepted Answer

The request does not include the required server-side encryption header.. The policy requires s3:x-amz-server-side-encryption to be AES256. If not specified, the condition fails and the request is denied. Option A is wrong because the resource is correct. Option C is wrong because the action is allowed. Option D is wrong because putting an object without encryption does not match the condition.

Answer

The policy does not allow the s3:PutObject action on the bucket itself.

Answer

The IAM user does not have permissions to use the s3:PutObject action.

Answer

The bucket policy overrides the IAM policy.

Question 4

A developer runs the AWS CLI command above to view the latest log stream for a Lambda function. The output shows a log stream with lastEventTimestamp of 1710493200000 (approximately 1 hour ago). However, the function was invoked 5 minutes ago and did not produce any errors. What is the MOST likely explanation?

Accepted Answer

The command returned only the oldest log stream because of the limit and ordering parameters.. The command only returns one log stream due to the limit 1 parameter. There may be newer log streams that are not shown. Option A is wrong because the function did not fail. Option B is wrong because the log stream exists. Option C is wrong because the function was invoked recently.

Answer

The Lambda function was not actually invoked 5 minutes ago.

Answer

The Lambda function execution role lacks permissions to write to CloudWatch Logs.

Answer

The log stream was deleted after the last invocation.

Question 5

A company deploys a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application allows users to retrieve data by calling a REST API. Recently, users have reported that some requests return HTTP 500 errors. The developer investigates and finds that the Lambda function logs show occasional 'ProvisionedThroughputExceededException' errors when writing to a DynamoDB table. The table has provisioned read capacity of 5 and write capacity of 5. The Lambda function is configured with a reserved concurrency of 10. The developer wants to minimize errors without significantly increasing costs. Which action should the developer take?

Accepted Answer

Enable auto scaling for the DynamoDB table with a minimum write capacity of 5 and a maximum of 10.. ProvisionedThroughputExceededException occurs when the DynamoDB table's provisioned write capacity (5 WCU) is exceeded by concurrent Lambda invocations (reserved concurrency of 10). Enabling DynamoDB auto scaling lets the table raise write capacity up to 10 WCU during bursts and scale back down when idle, absorbing the spikes without over-provisioning. This directly addresses the throttling at its source while keeping costs proportional to actual usage.

Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.

Answer

Increase the reserved concurrency for the Lambda function to 20.

Answer

Implement retry logic with exponential backoff in the Lambda function for DynamoDB write operations.

Question 6

A developer is managing an application that runs on an Amazon EC2 instance. The application uses an IAM role attached to the instance to access an S3 bucket. The developer recently updated the IAM role to add a new policy that grants access to a different S3 bucket. However, when testing, the application cannot access the new bucket and still returns 'Access Denied'. The developer verifies that the instance profile is correctly associated with the EC2 instance and that the new policy is attached. The application was restarted after the policy change. What is the MOST likely cause of the issue?

Accepted Answer

The temporary security credentials cached by the instance are still valid and do not reflect the new policy.. Temporary security credentials obtained from the instance metadata service are cached by the AWS SDK/CLI and do not automatically update when the IAM role policy changes. These credentials remain valid for their duration (default 6 hours) and continue to grant permissions based on the old policy. Restarting the application does not refresh the credentials; only when the credentials expire will new ones be obtained that include the updated policy. Option A is incorrect because the question states the new policy is attached and there is no indication of a bucket policy. Option C is incorrect because restarting the application multiple times does not refresh the cached credentials. Option D is incorrect because the instance profile was verified to be correctly associated.

Answer

The S3 bucket has a bucket policy that denies access to the IAM role.

Answer

The application needs to be restarted multiple times to pick up the new policy.

Answer

The instance profile is not correctly attached to the EC2 instance.

Question 7

A developer deployed a web application using AWS Elastic Beanstalk. The application uses an RDS MySQL database. After a recent deployment, the application's health status turned from 'Ok' to 'Severe'. The developer checks the environment events and sees that the database connection is failing. The RDS instance is in the same VPC and security group. The developer confirms that the database endpoint and credentials are correct. What is the MOST likely cause of the connection failure?

Accepted Answer

The security group for the Elastic Beanstalk environment no longer allows outbound traffic to the RDS database port.. Most likely correct because after a deployment, Elastic Beanstalk may update the security group rules for the environment. If the rule allowing outbound traffic to the RDS database port is missing, the application cannot connect. Option B is unlikely because the endpoint is confirmed as correct. Option C is irrelevant since the RDS instance is in the same VPC and security group, so public accessibility is not required. Option D is about the application starting, but the events show database connection failure, not a startup bug.

Answer

The RDS database endpoint changed after the deployment.

Answer

The RDS instance is not publicly accessible.

Answer

The application code is failing to start due to a bug.

Question 8

A company runs a critical application on Amazon ECS with Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. Recently, the company noticed that the ALB returns 502 Bad Gateway errors during peak traffic hours. The developer checks the ECS service metrics and sees that the number of running tasks remains constant, while CPU and memory utilization are below 50%. The ALB target group health checks are failing intermittently for some tasks. What is the MOST likely cause of the 502 errors?

Accepted Answer

The ALB idle timeout is set too low, causing connections to be closed before the application responds.. The ALB idle timeout determines how long the load balancer waits for a response from the target before closing the connection. If the application takes longer to respond than the timeout setting, the ALB terminates the connection and returns a 502 Bad Gateway error. The intermittent health check failures occur because some tasks may respond within the timeout while others do not, especially during peak traffic when processing times increase. Option A is incorrect because if the startup command were failing, tasks would never become healthy and health checks would consistently fail. Option B is incorrect because CPU and memory utilization below 50% indicate the tasks have spare capacity, so auto scaling would not resolve the latency issue. Option D is incorrect because if the security group were blocking traffic, health checks would consistently fail, not intermittently.

Answer

The task definition's startup command is failing, causing the tasks to never become healthy.

Answer

The ECS service is not configured with auto scaling to handle the increased traffic.

Answer

The security group for the ECS tasks is blocking traffic from the ALB.

Question 9

A developer's AWS Lambda function processes messages from an Amazon SQS standard queue. The function performs an API call that intermittently takes longer than the function's configured timeout. When this happens, the messages are not deleted from the queue and are received again by other concurrent Lambda invocations. The developer wants to prevent duplicate concurrent processing of the same message while still allowing the function to process messages in parallel. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

Implement idempotency in the function by using a conditional write to a DynamoDB table keyed on the SQS message ID before performing the API call.. The root cause is that a Lambda invocation can exceed its timeout while still running, and SQS will make the message visible again, allowing another invocation to pick it up. The robust fix is to make the processing idempotent so that duplicate deliveries do not cause duplicate side effects. A conditional write in DynamoDB keyed on the message ID ensures only one invocation performs the work, while other messages continue to be processed in parallel.

Answer

Use an SQS FIFO queue with MessageGroupId and a content-based deduplication ID.

Answer

Configure the SQS event source mapping with a batch size of 1 and a maximum concurrency of 1.

Answer

Increase the function's timeout and set the queue's visibility timeout to six times the function timeout.

Question 10

A developer is optimizing an AWS Lambda function that reads a 200 MB JSON configuration file from Amazon S3 on every invocation. The function is invoked thousands of times per hour, and the developer notices high latency and increased S3 GET request charges. The configuration file changes at most once per day. Which change will reduce latency and cost with the LEAST code change?

Accepted Answer

Cache the configuration file in the Lambda execution environment's /tmp directory and check S3 object metadata before re-downloading.. Lambda reuses execution environments, so storing the configuration in /tmp and validating freshness with a cheap metadata check avoids re-downloading the large file on every invocation. This reduces both latency and S3 request charges. The other options either hit size limits, only partially improve performance, or add unnecessary infrastructure complexity.

Answer

Store the configuration in AWS Systems Manager Parameter Store as a SecureString parameter and retrieve it on each invocation.

Answer

Increase the Lambda function's memory allocation to 3008 MB to improve network throughput.

Answer

Move the configuration file to an Amazon EFS file system mounted to the Lambda function and read it from there.

Question 11

A developer is using AWS X-Ray to trace a distributed application running on Amazon ECS and AWS Lambda. Some traces are incomplete, and the developer needs to ensure that X-Ray can correlate requests across services. Which two actions should the developer take to improve trace completeness? (Choose two.)

Accepted Answer

Enable active tracing on the Lambda function and grant the function's execution role permissions to call X-Ray APIs.. Complete X-Ray traces require that trace context be passed between services via the X-Amzn-Trace-Id header and that each service be instrumented to emit segments. For Lambda, this means enabling active tracing and granting X-Ray permissions. These two actions together ensure that requests are correlated end-to-end, while sampling and CloudTrail do not fix broken context propagation.

Answer

Use AWS CloudTrail to log all API calls and correlate them with X-Ray traces.

Answer

Increase the X-Ray sampling rate to 100% for all services.

Answer

Configure the X-Ray daemon to run as a sidecar container in the ECS task definition.

Question 12

A developer deployed a new version of an AWS Lambda function that is part of a serverless application. The function uses an Amazon DynamoDB table as a data store. After deployment, the developer notices that the function's latency has increased significantly for some requests. CloudWatch traces show that the increase is due to DynamoDB throttle events. The function is configured with a reserved concurrency of 100 and the DynamoDB table has 5 read capacity units (RCUs) and 5 write capacity units (WCUs). What is the most effective way to reduce the throttling while maintaining application performance?

Accepted Answer

Increase the read and write capacity units on the DynamoDB table. The primary cause of the throttling is insufficient DynamoDB capacity to handle the request volume from the Lambda function. Increasing the read and write capacity units (RCUs/WCUs) directly addresses the throttle events by providing more throughput to match the function's concurrency of 100. This is the most effective solution because it resolves the bottleneck at the data store level without reducing the application's ability to process requests concurrently.

Answer

Decrease the reserved concurrency of the Lambda function to 10

Answer

Enable DynamoDB Accelerator (DAX) for caching reads

Answer

Enable auto scaling on the DynamoDB table

Question 13

A developer is running an AWS Lambda function that is triggered by Amazon S3 events. The function writes processed data to an Amazon DynamoDB table. Over time, the function's execution time has increased significantly. CloudWatch Logs show many DynamoDBProvisionedThroughputExceededException errors. The table is configured with 5 read capacity units (RCUs) and 5 write capacity units (WCUs). The function performs both reads and writes. Which optimization will MOST effectively reduce throttling errors while maintaining performance?

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode. The DynamoDBProvisionedThroughputExceededException errors indicate that the Lambda function is exceeding the provisioned write capacity of 5 WCUs. Switching to on-demand capacity mode eliminates the need to manage throughput, automatically scaling to handle the workload without throttling. This directly resolves the root cause—capacity exhaustion—without requiring manual adjustments or architectural changes.

Answer

Increase the RCUs and WCUs of the table to 50 each

Answer

Implement a DynamoDB Accelerator (DAX) cluster for caching reads

Answer

Increase Lambda function memory to 1024 MB

Question 14

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During peak hours, users report receiving HTTP 503 (Service Unavailable) errors. The developer checks Amazon CloudWatch metrics and finds that the ALB's request count is high but below the limit, and the target group's healthy host count drops to zero intermittently. The Auto Scaling group for the instances is configured with a minimum of 2, maximum of 10, and a simple scaling policy to add 2 instances when CPU utilization exceeds 70% for 5 consecutive minutes. What is the most likely cause of the 503 errors?

Accepted Answer

The Auto Scaling group's cooldown period prevents new instances from being added quickly enough during rapid traffic spikes. The 503 errors occur because the simple scaling policy has a cooldown period (default 300 seconds) that prevents the Auto Scaling group from launching new instances during rapid traffic spikes. When CPU exceeds 70% for 5 minutes, the policy adds 2 instances, but the cooldown blocks further scaling actions until it expires, even if the newly launched instances are still initializing and the healthy host count drops to zero. This mismatch between traffic demand and scaling responsiveness causes the ALB to have no healthy targets, resulting in 503 errors.

Answer

The ALB's idle timeout is set too low, causing dropped connections

Answer

The Auto Scaling group's maximum capacity of 10 is insufficient

Answer

The health check grace period is preventing instances from being marked healthy

Question 15

A developer is troubleshooting an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function processes new objects and writes results to a DynamoDB table. Recently, some objects are not being processed. The developer checks the CloudWatch Logs for the Lambda function and sees no errors. Which TWO actions should the developer take to investigate the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the memory allocation of the Lambda function to the maximum available (10,240 MB). Increasing the memory allocation to the maximum (10,240 MB) proportionally increases the CPU and network throughput allocated to the Lambda function, which directly reduces execution time for CPU-bound pandas operations. Since memory utilization is only at 80% of the current 3,008 MB, the bottleneck is likely CPU, not memory, and Lambda's CPU scales linearly with memory configuration. This action resolves the timeout without any code changes.

Answer

Increase the function timeout to the maximum allowed (900 seconds is already the max)

Answer

Use S3 Select to filter columns and rows before invoking the Lambda function

Answer

Increase the batch size of the S3 event notification to invoke the function with multiple files