DVA-C02 Timed Practice Test 1 — 10 Questions

Question 1

A developer is troubleshooting an AWS Lambda function that is triggered by an S3 event. The function occasionally fails with a timeout error. CloudWatch logs show that the timeout occurs during the processing of large files. The function has a memory setting of 128 MB and a timeout of 3 seconds. The developer wants to process large files without modifying the code. Which parameter should the developer adjust first?

Accepted Answer

Increase the function's memory. Increasing the function's memory is the correct first step because Lambda allocates CPU proportionally to memory, and more CPU reduces processing time for CPU-bound tasks like decompressing or parsing large files. This directly addresses the timeout by making the function complete faster, without requiring code changes. The current 128 MB setting is the minimum, which provides the least CPU, so even a modest increase can significantly reduce execution time.

Answer

Increase the function's timeout

Answer

Increase the function's reserved concurrency

Answer

Increase the S3 event notification batch size

Question 2

A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use by default?

Accepted Answer

Temporary credentials from the instance profile role. Option D is correct because the AWS SDK on EC2 automatically retrieves temporary credentials from the instance metadata service (IMDS) at http://169.254.169.254/latest/meta-data/iam/security-credentials/. These credentials are provided by the IAM role attached to the EC2 instance (the instance profile role) and are rotated automatically, eliminating the need to store long-term credentials on the instance.

Answer

Static credentials committed to Git

Answer

A credentials file copied into the AMI

Answer

The root account access key

Question 3

A developer needs to allow an IAM user in a different AWS account to assume a role in the developer's account. The role has permissions to access an S3 bucket. Which policy is required in the developer's account to enable this cross-account access?

Accepted Answer

An IAM role with a trust policy that allows the external account's root user or specific IAM users/roles to assume the role. Option A is correct because cross-account IAM role access requires a trust policy attached to the role in the developer's account. This trust policy specifies the external AWS account ID (or specific IAM users/roles in that account) as the principal, allowing them to call sts:AssumeRole. Once the role is assumed, the developer's account grants the necessary S3 permissions via the role's permissions policy.

Answer

An S3 bucket policy granting access to the external account

Answer

An IAM user policy in the external account allowing sts:AssumeRole

Answer

An AWS Organizations service control policy allowing cross-account access

Question 4

A developer needs to grant an IAM role in Account B read-only access to objects in an S3 bucket in Account A. The bucket is encrypted with server-side encryption using AWS KMS (SSE-KMS) with a customer managed key (CMK) in Account A. Which combination of policies is required for the cross-account access to succeed?

Accepted Answer

The bucket policy in Account A grants s3:GetObject to the role, the KMS key policy grants kms:Decrypt to the role, and the role in Account B has an IAM policy allowing s3:GetObject and kms:Decrypt. Option A is correct because cross-account access to an SSE-KMS encrypted S3 bucket requires three layers of permissions: the bucket policy in Account A must grant s3:GetObject to the IAM role in Account B, the KMS key policy must grant kms:Decrypt to the same role, and the role's IAM policy in Account B must allow both s3:GetObject and kms:Decrypt. Without any one of these, the request will fail due to either an S3 authorization error or a KMS decryption failure.

Answer

The bucket policy in Account A grants s3:GetObject to the role, and the role in Account B has an IAM policy allowing s3:GetObject. No KMS permissions are needed because SSE-KMS uses AWS managed keys by default.

Answer

The bucket policy in Account A grants s3:GetObject to the role, and the KMS key policy grants kms:Decrypt to the role. The role in Account B does not need additional IAM policies because the bucket and key policies provide sufficient permissions.

Answer

Only the bucket policy in Account A needs to grant s3:GetObject to the role. KMS is not involved because the bucket is encrypted with SSE-KMS but the role can decrypt using the default KMS key.

Question 5

An API Gateway HTTP API should allow access only to users authenticated by an external OIDC provider. Which authorizer type is most appropriate?

Accepted Answer

JWT authorizer configured for the issuer and audience. Option C is correct because an HTTP API Gateway with an external OIDC provider requires a JWT authorizer. The JWT authorizer validates the token's signature, issuer, and audience against the OIDC provider's configuration, ensuring only authenticated users gain access. This is the native AWS mechanism for integrating third-party OIDC identity providers like Auth0 or Okta.

Answer

IAM authorizer

Answer

API key authorizer

Answer

S3 bucket policy

Question 6

A developer monitors an AWS Lambda function that processes messages from an Amazon SQS queue. CloudWatch logs show that the function's execution time has increased significantly over the past week, and it now frequently times out at the 5-minute timeout. The function's code has not been changed recently. The function makes calls to an Amazon DynamoDB table. What is the most likely cause of the increased execution time?

Accepted Answer

The DynamoDB table's read capacity units are underprovisioned, causing throttling.. The most likely cause is that the DynamoDB table's read capacity units are underprovisioned, leading to throttling (ProvisionedThroughputExceededException). When DynamoDB throttles requests, the Lambda function must retry them, which adds latency and can cause the function to exceed its 5-minute timeout. Since the code hasn't changed, this points to a scaling or capacity issue on the DynamoDB side.

Answer

The SQS queue's visibility timeout is too short, causing duplicate processing.

Answer

The Lambda function's memory is too low, causing CPU throttling.

Answer

The DynamoDB table's indexes are missing, causing full table scans.

Question 7

A developer needs to allow an EC2 instance to read from a DynamoDB table. Which is the best practice to grant permissions?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance.. The best practice for granting an EC2 instance permissions to access DynamoDB is to create an IAM role with the required permissions and attach it to the instance. This eliminates the need to manage long-term credentials, as the instance automatically retrieves temporary security credentials from the instance metadata service (IMDS) via the AWS Security Token Service (STS). This approach follows the principle of least privilege and ensures credentials are rotated automatically.

Answer

Generate an IAM user access key and store it in the application configuration.

Answer

Hardcode the AWS credentials in the application code.

Answer

Add the DynamoDB table ARN to the EC2 instance's security group.

Question 8

A developer is designing a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party identity provider (IdP). Which TWO services can be used to manage user authentication?

Accepted Answer

Amazon Cognito User Pools. Options A and D are correct. Cognito User Pools can integrate with third-party IdPs. API Gateway can use Lambda authorizers to validate tokens. Option B is wrong because IAM is for AWS users, not external IdPs directly. Option C is wrong because Secrets Manager is for secrets. Option E is wrong because STS is for temporary credentials, not authentication.

Answer

AWS IAM

Answer

AWS Security Token Service (STS)

Answer

AWS Secrets Manager

Question 9

A developer wants to grant a user in a different AWS account access to an S3 bucket. The developer has written a bucket policy that allows the user's IAM user ARN. However, the access is still denied. What is the most likely reason?

Accepted Answer

The user's IAM user policy does not explicitly allow the required S3 action. When granting cross-account access to an S3 bucket, both the bucket policy (resource-based policy) and the user's IAM policy (identity-based policy) must explicitly allow the action. The bucket policy alone is insufficient if the user's IAM policy does not include an explicit Allow for the S3 action, because IAM denies by default. Even though the bucket policy grants access, the user's own IAM policy must also permit the operation for the request to succeed.

Answer

The bucket policy does not have a principal of '*' to allow external accounts

Answer

The bucket is in a different region than the user's account

Answer

The user is using the wrong S3 endpoint (e.g., path-style vs virtual-hosted)

Question 10

Based on the CloudTrail log entry, which security concern should be investigated?

Accepted Answer

Multi-factor authentication (MFA) was not used when assuming the role.. The CloudTrail log entry shows that the `sts:AssumeRole` API call was made without the `aws:MultiFactorAuthPresent` key set to `true`. This indicates that the role was assumed without MFA, which violates the security best practice of requiring MFA for privileged role assumptions. The absence of MFA increases the risk of unauthorized access if the user's credentials are compromised.

Answer

The role used has too many permissions.

Answer

The instance was launched in an unauthorized region.

Answer

The source IP address is from a suspicious location.