DVA-C02 Timed Practice Test 3 — 10 Questions

Question 1

A developer notices that the Lambda function 'my-function' is not generating any logs in CloudWatch, although the function is invoked successfully. The developer runs the command above. What is the MOST likely cause?

10 minute time limit — choose an answer to begin.

Accepted Answer

The Lambda function's execution role is missing the 'logs:CreateLogStream' and 'logs:PutLogEvents' permissions.. The log group exists but has 0 stored bytes, meaning no log streams have been created. This typically indicates that the Lambda function's execution role does not have permissions to create log streams and put log events. The function runs but fails silently to write logs.

Answer

The log group retention policy is set to 0 days.

Answer

The Lambda function is configured to log to a custom log group.

Answer

The Lambda function has reserved concurrency set to 0.

Question 2

A company uses AWS CodePipeline with CodeBuild to deploy a Node.js application. The build fails intermittently with 'npm ERR! network' errors. What is the most likely cause and solution?

Accepted Answer

The build environment lacks outbound internet access; configure a NAT gateway or use a VPC endpoint for npm.. The 'npm ERR! network' error indicates that npm cannot reach the registry to download packages. If AWS CodeBuild is configured to run inside a VPC, it requires outbound internet access to reach the public npm registry. If CodeBuild is configured with multiple subnets and some of them lack a route to a NAT gateway, the builds will fail intermittently depending on which subnet the build container is provisioned in. To resolve this, ensure all configured subnets have a route to a NAT gateway, or host your packages in AWS CodeArtifact and use a VPC endpoint to access them privately.

Answer

A unit test is failing; fix the test code.

Answer

The npm cache is corrupted; clear the cache in CodeBuild.

Answer

The npm token has expired; regenerate the token.

Question 3

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket with a bucket policy that grants public read access. The stack creation fails with the error 'Access Denied for bucket: bucket-policy does not allow access.' The developer has full administrative permissions in AWS. The developer verifies that the bucket policy is correctly formatted. What is the most likely cause of the failure?

Accepted Answer

The S3 Block Public Access settings are enabled at the account level, preventing the bucket policy from granting public access.. AWS S3 Block Public Access settings (at the account or bucket level) prevent the creation of public bucket policies. When CloudFormation attempts to apply a public bucket policy while Block Public Access is enabled, S3 rejects the PutBucketPolicy API call with an 'Access Denied' error. Since the developer has full administrative permissions, the failure is not due to missing IAM permissions but rather S3 Block Public Access blocking the public policy.

Answer

The developer does not have permissions to create S3 buckets.

Answer

The S3 bucket name is already in use by another account.

Answer

The S3 bucket is encrypted with AWS KMS, and the bucket policy does not include kms:Decrypt permissions.

Question 4

Which TWO services can be used to encrypt data at rest in Amazon S3? (Choose two.)

Accepted Answer

SSE-KMS. Options A and E are correct. Option A: SSE-KMS uses AWS Key Management Service (KMS) for managing encryption keys, providing additional control and audit capabilities. Option E: SSE-S3 uses S3-managed keys for encryption at rest. Option B is incorrect because AWS IAM is an access management service, not an encryption service. Option C is incorrect because AWS Certificate Manager (ACM) handles SSL/TLS certificates, not data encryption. Option D is incorrect because AWS CloudHSM provides hardware security modules but is not directly integrated with S3 for encryption.

Answer

AWS IAM

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 5

Refer to the exhibit. A developer creates this CloudFormation template and tries to deploy it. The deployment fails with 'CREATE_FAILED' for the S3 bucket resource. What is the most likely cause?

Accepted Answer

The bucket name is already taken by another AWS account.. S3 bucket names must be globally unique across all AWS accounts. If the bucket name specified in the template is already in use by another account, CloudFormation will fail with CREATE_FAILED for the S3 bucket resource. This is a fundamental requirement of the S3 service, not a template syntax or configuration issue.

Answer

The template does not enable versioning on the bucket.

Answer

The bucket name must be in all lowercase letters.

Answer

The template does not specify a bucket policy.

Question 6

A developer is creating a CloudFormation template to deploy a microservices architecture. The template includes an Amazon ECS service with an Application Load Balancer. The developer wants to ensure that the load balancer is created before the ECS service. How should the developer achieve this?

Accepted Answer

Use the DependsOn attribute in the ECS service resource to reference the load balancer.. The DependsOn attribute explicitly defines resource creation order in AWS CloudFormation. By setting DependsOn on the ECS service to reference the load balancer, the template ensures the load balancer is fully created before the ECS service attempts to register with it, preventing deployment failures due to missing dependencies.

Answer

Use the Ref function in the ECS service to reference the load balancer.

Answer

Define the load balancer before the ECS service in the template.

Answer

Use the Fn::GetAtt function to reference the load balancer.

Question 7

A developer needs to store session state for a stateless web application running on EC2 instances behind an Application Load Balancer. Which AWS service should the developer use to ensure session data is not lost if an instance fails?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL database that provides fast and predictable performance with seamless scalability. It is highly recommended for storing session state in stateless applications because it is serverless, highly durable, and requires no cluster management, unlike ElastiCache. AWS SDKs even offer native session state providers for DynamoDB.

Answer

Amazon S3

Answer

Amazon ElastiCache

Answer

Amazon RDS

Question 8

A developer created a CloudFormation template to host a static website. After deployment, the website returns 403 Forbidden errors. What is the most likely cause?

Accepted Answer

The bucket policy does not allow public access.. An 'Access Denied' (403 Forbidden) error on an Amazon S3 static website endpoint indicates that the requester does not have permission to access the resource. By default, all new S3 buckets and objects are private. To allow public access to the website's assets, you must add a bucket policy that grants public read permissions (`s3:GetObject`) to anonymous users, and ensure that S3 Block Public Access settings are disabled. If static website hosting were not enabled, the website endpoint would not return a 403 Forbidden error; it would not resolve or would return a 404 error. Therefore, the missing bucket policy is the most likely cause.

Answer

The bucket has versioning enabled, which blocks public access.

Answer

The bucket name is not unique.

Answer

The bucket does not have static website hosting enabled.

Question 9

A developer is deploying a Node.js application on AWS Lambda. The function uses the 'axios' library to call an external API. After deployment, the function times out after 3 seconds. The external API response time is normally under 500 ms. What should the developer do to resolve this issue?

Accepted Answer

Remove the Lambda function from the VPC.. When a Lambda function is configured to run inside a VPC, it loses its default internet access. If the function needs to call an external API, the connection will hang and eventually time out. Increasing the timeout (Option A) will not resolve this, as the network path is blocked. To resolve this, the developer should either configure a NAT Gateway in the VPC or, if VPC resources are not required, remove the Lambda function from the VPC (Option C) to restore default internet access.

Answer

Increase the Lambda function timeout to 10 seconds.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the Lambda function memory to 1024 MB.

Question 10

A developer is building a real-time chat application using Amazon API Gateway WebSockets and AWS Lambda. The developer notices that messages are sometimes delivered out of order. What should the developer do to ensure ordered message delivery?

Accepted Answer

Use an Amazon SQS FIFO queue to buffer messages before processing. WebSocket connections run over TCP, which guarantees in-order delivery of frames from the client to Amazon API Gateway. However, when API Gateway routes these messages to AWS Lambda, Lambda executes concurrently. This concurrent execution can lead to messages being processed, written to a database, or broadcasted to other clients out of order. To guarantee ordered processing, messages can be buffered using an Amazon SQS FIFO (First-In-First-Out) queue before being processed by Lambda, ensuring they are handled in the exact order they were received.

Answer

Increase the Lambda function's memory allocation

Answer

Use API Gateway's built-in message ordering feature

Answer

Set the 'sequenceNumber' property in the WebSocket message