DVA-C02 Troubleshooting and Optimization Practice Test 9 — 15 Questions

Question 1

A company runs a critical application on EC2 instances behind an Application Load Balancer. The application experiences intermittent 503 errors. The health checks are configured correctly and the instances pass health checks consistently. What is the most likely cause?

Accepted Answer

The application response time exceeds the ALB idle timeout. Option D is correct because if the application takes longer than the idle timeout to respond, the ALB returns a 503. Option A is wrong because the target group might be deregistering instances that are terminating, but this would show as unhealthy. Option B is wrong because security groups denying traffic would cause connection timeouts, not 503. Option C is wrong because the health check path issue would cause health check failures, not intermittent 503.

Answer

The health check path is incorrect

Answer

The target group is deregistering instances prematurely

Answer

A security group is blocking traffic from the ALB to the instances

Question 2

A developer is deploying a new version of a Lambda function and wants to roll back immediately if errors are detected. Which deployment strategy should the developer use?

Accepted Answer

Use AWS CodeDeploy with a canary deployment configuration. Option A is correct because canary deployments allow shifting a small percentage of traffic to the new version and monitoring before full rollout. Option B is wrong because linear deployments shift traffic in increments but do not have automatic rollback. Option C is wrong because rolling updates are for EC2, not Lambda. Option D is wrong because immutable updates replace all instances and do not support gradual traffic shifting.

Answer

Use an EC2 rolling update strategy

Answer

Use AWS CodeDeploy with a linear deployment configuration

Answer

Use an immutable update strategy

Question 3

A development team is using AWS CodeCommit as a source repository and CodeBuild for build automation. They want to trigger a build automatically whenever a pull request is created or updated in the repository. Which configuration should they use?

Accepted Answer

Use Amazon EventBridge to capture CodeCommit events and trigger CodeBuild. Option B is correct because CodeCommit can send events via CloudWatch Events (Amazon EventBridge) to trigger CodeBuild. Option A is wrong because webhooks are used with GitHub/Bitbucket, not CodeCommit. Option C is wrong because CodePipeline is a higher-level orchestration service and not necessary for simple build triggers. Option D is wrong because S3 events are not applicable to CodeCommit.

Answer

Configure an S3 event notification on the repository

Answer

Configure a webhook in CodeCommit to trigger CodeBuild

Answer

Create a CodePipeline that polls CodeCommit for changes

Question 4

An application uses an Auto Scaling group with a launch configuration that includes a user data script to configure instances. After a scaling event, new instances launch but fail to register with the target group. The existing instances continue to work. What should the developer do to resolve this issue?

Accepted Answer

Create a new launch configuration with corrected user data and update the Auto Scaling group. Option D is correct because the launch configuration is immutable; changes to it are not applied to existing instances. Updating the launch configuration and launching new instances will use the corrected user data. Option A is wrong because the Auto Scaling group does not automatically update launch configurations. Option B is wrong because modifying the launch configuration does not affect running instances. Option C is wrong because recreating the Auto Scaling group is unnecessary.

Answer

Modify the existing launch configuration with the correct user data

Answer

Update the Auto Scaling group to use the latest launch configuration version

Answer

Delete and recreate the Auto Scaling group

Question 5

A developer is troubleshooting an AWS Lambda function that is failing with an 'AccessDenied' error when trying to write to an S3 bucket. The function's execution role has the following policy. What is the most likely cause of the failure? (Policy: { 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Action': 's3:PutObject', 'Resource': 'arn:aws:s3:::my-bucket/*' } ] })

Accepted Answer

The resource ARN does not include the bucket itself; it only includes objects. Option B is correct because the resource ARN 'arn:aws:s3:::my-bucket/*' only allows objects inside the bucket, but the bucket itself is 'arn:aws:s3:::my-bucket'. The policy needs to include both the bucket and its contents for operations like 's3:PutObject'. Option A is wrong because the action 's3:PutObject' is correct. Option C is wrong because the policy is in the correct format. Option D is wrong because the action is allowed.

Answer

The policy is missing a 'Principal' element

Answer

The action 's3:PutObject' is not allowed for Lambda execution roles

Answer

The action 's3:PutObject' is not sufficient; need 's3:*'

Question 6

A company runs a web application on EC2 instances in an Auto Scaling group. The application needs to store session state. The architecture must be highly available and scalable. Which solution should the developer choose?

Accepted Answer

Use Amazon ElastiCache for Redis to store session state. Option C is correct because ElastiCache (Redis) provides a highly available, low-latency, and scalable session store that is external to the instances. Option A is wrong because storing session data on the local instance's ephemeral storage is not durable and cannot be shared across instances. Option B is wrong because sticky sessions (session affinity) can cause uneven load and are not highly available if an instance fails. Option D is wrong because storing session data in an S3 bucket would be slow and not designed for low-latency session access.

Answer

Use sticky sessions on the Application Load Balancer

Answer

Store session data in an S3 bucket

Answer

Store session data in the instance's ephemeral storage

Question 7

A developer is using AWS CodePipeline to automate a multi-stage pipeline. The pipeline includes a manual approval step before deploying to production. The developer wants to receive an email notification when the pipeline reaches the approval step. Which service should the developer use?

Accepted Answer

Use Amazon CloudWatch Events to detect the pipeline state change and trigger an SNS notification. Option B is correct because CloudWatch Events (EventBridge) can detect the pipeline state change (e.g., stage execution state changed to 'waiting') and trigger an SNS topic to send email. Option A is wrong because CodePipeline does not directly send email notifications. Option C is wrong because CloudWatch Logs is for logging, not notifications. Option D is wrong because SES is for sending emails directly, but CloudWatch Events with SNS is the standard approach.

Answer

Configure CodePipeline to send an email using the 'Email' action

Answer

Use Amazon CloudWatch Logs to monitor the pipeline logs and trigger an alarm

Answer

Use Amazon Simple Email Service (SES) to send an email from the pipeline

Question 8

Which TWO services can be used to store and retrieve application configuration data in AWS? (Choose 2)

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store (Option C) is a managed service specifically designed to store and retrieve application configuration data, such as database connection strings, passwords, and license keys. It integrates with AWS KMS for encryption and supports hierarchical parameter paths, making it ideal for configuration management without custom code.

Answer

AWS CloudTrail

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon DynamoDB

Question 9

Which THREE factors should a developer consider when designing a stateless application on AWS? (Choose 3)

Accepted Answer

Avoid storing data on the local file system of the instances. Options A, C, and D are correct. A stateless application should store session state externally (e.g., ElastiCache), use a shared database for data storage, and avoid storing state on local instance storage. Option B is wrong because sticky sessions create statefulness. Option E is wrong because storing state in memory makes the instance stateful.

Answer

Store session state in the instance memory for low latency

Answer

Use sticky sessions on the load balancer to maintain session affinity

Question 10

Which TWO actions can help reduce the cold start time for an AWS Lambda function? (Choose 2)

Accepted Answer

Increase the function's memory allocation. Options A and D are correct. Increasing memory allocation also increases CPU, which can speed up initialization. Keeping the function warm by using a scheduled CloudWatch Event invokes the function periodically to prevent the container from being reclaimed. Option B is wrong because using a VPC adds network latency and increases cold start time due to ENI creation. Option C is wrong because using a larger deployment package increases download time. Option E is wrong because provisioned concurrency eliminates cold starts but is not a reduction factor; it's a different solution.

Answer

Place the Lambda function in a VPC

Answer

Use a larger deployment package with all dependencies included

Answer

Use provisioned concurrency to pre-warm the function

Question 11

The above IAM policy is attached to an IAM user. The user is unable to invoke the Lambda function 'my-function'. What is the most likely reason?

Accepted Answer

The Lambda function does not have a resource-based policy allowing the user to invoke it. Option D is correct because the function might have a resource-based policy that explicitly denies the user, or the function's permissions do not allow cross-account access. However, the most common issue is that the function's resource-based policy does not grant invoke permission to the user. The IAM policy allows the action, but the function also needs to allow the user via a resource-based policy. Option A is wrong because the action is correct. Option B is wrong because the resource is specific. Option C is wrong because the version is correct.

Answer

The resource ARN is missing the function version or alias

Answer

The action 'lambda:InvokeFunction' is not sufficient; need 'lambda:*'

Answer

The policy version is incorrect

Question 12

A developer ran the above CLI command to describe an EC2 instance. The instance is running but the developer cannot connect to it via SSH. Which additional step should the developer take to troubleshoot the connectivity issue?

Accepted Answer

Check the security group rules associated with the instance. Option C is correct because checking the security group rules is essential to verify that inbound SSH traffic (port 22) is allowed. The describe-instances output does not include security group information. Option A is wrong because the instance is already running. Option B is wrong because the instance type is t2.micro, which has a default ENI limit. Option D is wrong because the AMI ID is present.

Answer

Check the AMI ID to ensure it is a valid Linux AMI

Answer

Check the instance's network interfaces for a public IP

Answer

Check the instance status checks in the EC2 console

Question 13

The above CloudWatch alarm is configured for an EC2 instance. The alarm state is 'INSUFFICIENT_DATA' and has been for 2 days. Which of the following is the most likely cause?

Accepted Answer

The CloudWatch agent is not installed on the EC2 instance. Option A is correct because INSUFFICIENT_DATA means the metric data is not available. The most common reason is that the CloudWatch agent is not installed or configured to send the CPUUtilization metric. Option B is wrong because the instance is running, but that doesn't guarantee metric data. Option C is wrong because if the alarm period and evaluation periods are correct, the alarm would evaluate to OK or ALARM if data existed. Option D is wrong because the threshold is not the issue; the issue is lack of data.

Answer

The EC2 instance is stopped

Answer

The alarm period and evaluation periods are misconfigured

Answer

The threshold is set too high for the metric

Question 14

A developer notices that an AWS Lambda function configured with a VPC is timing out when trying to access an Amazon S3 bucket. The function has the necessary IAM permissions. What is the most likely cause?

Accepted Answer

The Lambda function does not have a route to the internet or a VPC endpoint for S3.. A VPC-enabled Lambda function has no internet access unless configured with a NAT Gateway/Instance or VPC Endpoint. To access S3, the function either needs a VPC endpoint for S3 or a route to the internet via a NAT device. The IAM permissions are not the issue. Option A is wrong because the timeout is not due to IAM. Option B is wrong because security group rules would affect different resources. Option C is correct. Option D is wrong because Lambda can be in a VPC but needs proper routing.

Answer

Lambda functions cannot be configured inside a VPC.

Answer

The Lambda function's execution role lacks S3 permissions.

Answer

The security group attached to the Lambda function does not allow outbound traffic to S3.

Question 15

A developer is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The build fails with the error 'no basic authentication credentials'. The build project has an IAM role with the AmazonEC2ContainerRegistryPowerUser policy. What is the most likely cause?

Accepted Answer

The buildspec does not include the pre_build step to authenticate with ECR.. CodeBuild needs to authenticate with ECR before pushing. The IAM role provides permissions, but the buildspec must include the aws ecr get-login-password command and pipe it to docker login. Option C is correct. Option A is wrong because the policy is sufficient. Option B is wrong because Docker is available. Option D is wrong because network connectivity is typically fine.

Answer

The build project is not configured to use a VPC that can reach ECR.

Answer

The build environment does not have Docker installed.

Answer

The IAM role does not have sufficient permissions to push to ECR.