DVA-C02 practice questions and answers

Correct answer: A — Configure the SQS queue as an event source mapping for the function; Lambda deletes messages when the function returns successfully.

An event source mapping makes Lambda poll the queue, invoke the function with a batch, and delete the messages automatically when the invocation succeeds. Failed messages become visible again and eventually go to a dead-letter queue. Manual polling and scheduled invocations reinvent that machinery badly.

Correct answer: A — Add `orderDate` as the sort key of the table.

With a composite key of partition key plus sort key, a Query returns all items for a customer already sorted by the sort key, and can use ranges such as 'last 30 days'. Scans read the whole table and cost far more. A single large item hits the 400 KB item limit.

Correct answer: A — Amazon Cognito user pools with an identity pool

A Cognito user pool handles sign-up and sign-in, including federated identity providers such as Google, and an identity pool exchanges that token for temporary AWS credentials. Creating IAM users per end user does not scale and is not the intended pattern.

Correct answer: A — kms:Decrypt on the key, plus permission to read the secret or parameter

To read an encrypted value the role needs the read action (for example `secretsmanager:GetSecretValue` or `ssm:GetParameter`) and `kms:Decrypt` on the key, and the key policy must allow the role. Nothing decrypts automatically with a customer managed key.

Correct answer: A — A Lambda alias with weighted routing, deployed by AWS CodeDeploy with a canary configuration

CodeDeploy supports canary and linear traffic shifting for Lambda by adjusting the weights on an alias, and it rolls back automatically when a CloudWatch alarm fires. The other options either have no gradual shift or no automated rollback tied to function metrics.

Correct answer: D — Immutable

Immutable deployments launch a full new set of instances in the same Auto Scaling group and swap them in, so rollback is simply terminating the new instances. Rolling policies replace instances in batches and roll back more slowly, and all-at-once causes downtime.

Correct answer: A — AWS X-Ray tracing

X-Ray produces a service map and traces with timing for each segment, which is exactly how you find the slow hop. CloudTrail records API calls for audit, Logs Insights queries log text without end-to-end timing, and flow logs show network traffic only.

Correct answer: A, B — Switch the table to on-demand capacity mode. · Implement exponential backoff with jitter for retries in the SDK.

Throttling means the table cannot serve the request rate: on-demand mode scales capacity automatically, and exponential backoff spreads retries instead of hammering the table. A longer timeout, a new index, or more memory do not add table capacity.

Correct answer: A — Stage-level caching with a TTL

API Gateway caching is enabled per stage with a cache size and TTL, and it serves repeated requests without calling the integration. Usage plans throttle and meter API keys, validators reject malformed requests, and mapping templates transform payloads.

Correct answer: A — A presigned URL generated by the backend

A presigned URL carries a short-lived signature for one specific operation and object, so the browser can upload straight to S3 while credentials stay on the server. Keys in JavaScript and anonymous PUT permissions are serious security holes.

Correct answer: A — AWS Step Functions

Step Functions state machines handle sequencing, retries, choices, parallel branches and long waits — including callback tasks that pause until a token is returned. Lambda has a 15-minute maximum runtime, so it cannot wait for days.

Correct answer: A — Parameters

Parameters accept values at stack creation or update. Outputs export values from a stack, Mappings hold static lookup tables such as Region-to-AMI, and Conditions decide whether resources are created.

Correct answer: A — Increase the memory setting, because Lambda allocates CPU power proportionally to memory.

In Lambda, memory is the only performance dial: CPU (and network) scale with the memory you configure, and a function crosses one full vCPU at 1,769 MB. A CPU-bound function that barely uses its RAM still runs faster with more memory allocated, and often costs the same or less because duration drops. A longer timeout just permits a slow run, lowering memory makes it slower, and VPC configuration does not add CPU.

Correct answer: A, B — Choose a partition key with higher cardinality, such as the device ID, so records spread evenly across shards. · Increase the number of shards, or switch the stream to on-demand capacity mode.

Write throughput is per shard, so throttling with one hot shard means the partition key concentrates records — a high-cardinality key spreads them — and the stream as a whole may simply need more capacity. Retention controls how long records stay readable. Enhanced fan-out gives each consumer its own read throughput and does nothing for producer throttling. Encryption is unrelated.

Correct answer: A — Create a second API Gateway stage (for example `beta`) and use a stage variable that points the integration at a different Lambda alias.

Stages are separate deployments of the same API definition, and stage variables can be used in the integration URI to select a Lambda alias per stage — so `beta` invokes the new alias and `prod` keeps the stable one. Duplicating the API doubles the maintenance. Repointing an alias affects all callers. Branching inside the function mixes two versions of the code in one deployable.

Correct answer: A — Create signed URLs using a public key uploaded to CloudFront and referenced by a trusted key group.

Trusted key groups are the current recommended mechanism: you upload a public key to CloudFront, add it to a key group, and sign URLs with the matching private key, setting an expiry per URL. Trusted signers based on root-account key pairs are the legacy approach AWS advises against. Geo restrictions filter by country, not by customer. Renaming public objects is security by obscurity.

Correct answer: A — An Amazon Cognito user pool for sign-in, plus an identity pool that exchanges the token for temporary AWS credentials.

A user pool handles registration, sign-in and federation with social providers, and returns JWTs. Those tokens are not AWS credentials — an identity pool trades them via STS for temporary credentials tied to an IAM role, which can even restrict S3 prefixes per user with policy variables. Per-player IAM users do not scale, and IAM Identity Center is for workforce access, not app end users.

Correct answer: A — A bucket policy that denies s3:PutObject when the s3:x-amz-server-side-encryption condition key is not aws:kms.

A bucket policy with a Deny and the encryption condition key is what actually rejects a non-conforming request — that is the stated requirement. Default encryption silently encrypts instead of rejecting, so a request without the header still succeeds. Allowing PutObject grants access without constraining it. Object Lock prevents deletion, not unencrypted writes.

Correct answer: A — Enable TTL on the table and write an attribute holding the expiry time as a Unix epoch value in seconds.

DynamoDB TTL deletes expired items in the background at no extra cost — you enable it on a numeric attribute containing epoch seconds. Deletion is not immediate (typically within 48 hours), which is fine for a 30-day retention rule. A scanning Lambda burns read and write capacity. PITR is a backup feature, and you cannot delete items 'from' an index.

Correct answer: A — The environment is running a mix of the old and new application versions, and another deployment is needed to make all instances consistent.

A failed rolling deployment leaves the already-updated batches on the new version and the rest on the old one, so you must deploy again — usually the previous version — to converge. Only immutable and blue/green style deployments give a clean automatic fallback, which is exactly why teams choose them for production despite the extra instances.

Correct answer: A — Increase the queue's visibility timeout beyond the maximum processing time, and call ChangeMessageVisibility from the consumer when a message takes longer.

A message becomes visible again when the visibility timeout expires, so a 30-second timeout on work that takes 90 seconds guarantees another consumer will pick it up. Raise the timeout, and extend it dynamically with ChangeMessageVisibility for long jobs. Retention controls how long unprocessed messages survive, long polling reduces empty responses, and delay seconds postpones first delivery — none of them affect redelivery mid-processing.

Correct answer: A — AWS Systems Manager Parameter Store using SecureString parameters.

Parameter Store supports hierarchical names such as /app/prod/db/password, keeps version history, encrypts SecureString values with KMS, and standard parameters are free — the right fit when automatic rotation is not needed. Secrets Manager charges per secret per month and its main advantage is rotation. Environment variables cannot be shared across applications, and an S3 object is a hand-built store with no versioned parameter API.

Correct answer: A, B — The X-Ray daemon is installed and running on the instance, listening on UDP port 2000. · The instance profile role grants xray:PutTraceSegments and xray:PutTelemetryRecords.

The SDK does not call the X-Ray API directly — it sends segments over UDP to the local X-Ray daemon, which buffers and uploads them, so the daemon must be running and the instance role must allow the two X-Ray write actions (the AWSXRayDaemonWriteAccess managed policy covers them). Public IPs are unnecessary if there is a route or VPC endpoint, detailed monitoring is a metrics resolution setting, and X-Ray does not read traces from CloudWatch Logs.

Correct answer: A — Use UpdateItem with a ConditionExpression that checks a version attribute, and retry when the condition fails.

This is optimistic locking: keep a version number on the item and make the write conditional on that value, so a stale write fails with ConditionalCheckFailedException and can be retried with fresh data. PutItem simply overwrites. Strongly consistent reads fix read staleness, not write conflicts. BatchWriteItem does not support condition expressions and is not atomic across items.

Correct answer: A — Declare Outputs with Export names in the network stack and use Fn::ImportValue in the application stack.

Cross-stack references work through exported outputs: the producing stack exports a value under a unique name, and consumers import it, which also blocks deletion of a resource another stack depends on. Ref and GetAtt only resolve resources inside the same template. Hard-coding IDs into Mappings breaks the moment the network stack is rebuilt.

Correct answer: A — Transform: AWS::Serverless-2016-10-31

The Transform declaration tells CloudFormation to run the SAM macro, which expands shorthand types such as AWS::Serverless::Function into full CloudFormation resources — without it the template is invalid. The template format version is optional, Globals is an optional convenience section, and the Application type is one specific resource.

Correct answer: A — Store the document in Amazon S3 and send a message containing the object key, or use the SQS Extended Client Library which does this for you.

SQS messages are capped at 256 KB, and the standard answer is the claim-check pattern: put the payload in S3 and pass a pointer. The Extended Client Library implements it transparently for Java. The message size limit is not adjustable, manual chunking makes the consumer responsible for ordering and reassembly, and attributes count toward the same 256 KB.

Correct answer: A — Package the function as a container image of up to 10 GB, push it to Amazon ECR, and create the function from that image.

Container image support raises the limit to 10 GB and is the intended path for heavy runtimes such as machine learning libraries; the image must live in ECR and include the Lambda runtime interface client. Layers share the same 250 MB unzipped quota, so five of them do not help. Downloading gigabytes into /tmp lengthens every cold start, and the package quota is not adjustable.

Correct answer: A — Add a Retry block with IntervalSeconds, MaxAttempts and BackoffRate to the task state, plus a Catch block routing to the compensation state.

Retry and Catch are built into task states: Retry defines attempts, initial interval and backoff rate for matching error names, and Catch redirects to another state when retries are exhausted. Copying the task three times duplicates logic. Express workflows change execution semantics and pricing, not automatic retries. Retrying inside the function hides the failures from the state machine and burns Lambda duration.

Correct answer: A — Mount an Amazon EFS file system as a volume in the task definition.

EFS is the shared, durable file system that Fargate tasks can mount across Availability Zones, and the data outlives individual tasks. Bind mounts and the container filesystem are ephemeral. There is no per-task EBS attachment on Fargate for shared multi-AZ access, and baking files into the image makes every change a redeploy.

Correct answer: A — Configure ECS service auto scaling with a target tracking policy on ALBRequestCountPerTarget or average CPU utilization.

Service auto scaling with target tracking adjusts the task count to hold a metric near a target — request count per target is the natural signal for spiky HTTP traffic. Running at peak all the time wastes money. The circuit breaker handles failed deployments. A longer idle timeout hides slow responses rather than adding capacity.

Correct answer: A — Install the CodeDeploy agent, register each server as an on-premises instance with an IAM identity, and tag the registered instances.

CodeDeploy supports on-premises instances, but each one must be registered with CodeDeploy against an IAM user or role, have the agent installed and configured with those credentials, and carry tags so a deployment group can select it. Nothing is auto-discovered, and Direct Connect is only network connectivity.

Correct answer: A — Create a cross-account IAM role in the repository's account with CodeCommit permissions, and let the developers' account assume it.

Cross-account access to CodeCommit uses role assumption: the repository account defines a role with the needed CodeCommit actions and trusts the other account, and developers assume it (with git-remote-codecommit making the credential handling painless). Sharing Git credentials shares one identity and destroys the audit trail. CodeCommit repositories cannot be public, and mirroring creates two sources of truth.

Correct answer: A — Add a reports section to the buildspec so CodeBuild creates test report groups from the JUnit output, and read the pass/fail trends in the CodeBuild console.

CodeBuild test reporting parses standard formats such as JUnit XML and Cucumber JSON into report groups, showing pass rates, durations and trends with no parsing code. Log queries and custom metrics can approximate this but you build and maintain them. Exporting build history gives outcomes per build, not per test case.

Correct answer: A — Set reserved concurrency on the checkout function to guarantee it capacity, and cap the reporting function's reserved concurrency.

Concurrency is a shared account-level pool, so a noisy function can starve everything else. Reserved concurrency does two things at once: it guarantees that slice for the critical function and it caps the function it is set on — so reserving for checkout and capping reporting fixes both sides. Memory affects speed, not concurrency. Provisioned concurrency removes cold starts and would reserve even more capacity for the batch job. The runtime is irrelevant.

Correct answer: A — Call UpdateItem with an ADD or SET expression — it creates the item when the key does not exist.

UpdateItem is an upsert: if no item matches the key it creates one, and an atomic counter expression such as SET score = if_not_exists(score, :zero) + :inc applies the increment server-side in one call. Read-then-write introduces a race between the two calls. The two-step conditional put is the same race with extra requests. BatchWriteItem does not support update expressions.

Correct answer: A — Use DynamoDB export to Amazon S3, which requires point-in-time recovery to be enabled on the table.

Export to S3 reads from the continuous backup rather than the table, so it costs no read capacity and does not touch live traffic; PITR must be on, and the output is DynamoDB JSON or Ion that Athena can query. Scanning consumes capacity. Streams carry ongoing changes, not a full snapshot. On-demand backups can only be restored into DynamoDB, not downloaded.

Correct answer: A — A Lambda authorizer that validates the token and returns an IAM policy document.

A Lambda authorizer is the extension point for tokens API Gateway does not understand natively: your code validates the token however the provider requires and returns an allow/deny policy, which API Gateway caches. Cognito authorizers only accept user pool tokens. SigV4 requires AWS credentials rather than a third-party token. API keys identify a client for throttling and metering and are not authentication.

Correct answer: A — Enable AWS CloudTrail data events for that bucket.

Object-level API activity is captured by CloudTrail data events, which record the identity, action, resource and time and are delivered reliably for audit use. Server access logging is best-effort with delayed, sometimes incomplete delivery, and AWS recommends CloudTrail when the logs matter for security. Storage Lens and request metrics report usage statistics, not individual calls.

Correct answer: A — Use an SQS FIFO queue with a message group ID per account and a message deduplication ID per transfer.

FIFO queues give exactly-once processing within a five-minute deduplication window — a repeated deduplication ID is simply discarded — and message group IDs keep strict order per account while still allowing different accounts to be processed in parallel. Deduplicating by hand in a table is the workaround for standard queues, which are at-least-once. SNS standard fan-out and delay seconds address neither ordering nor duplicates.

Correct answer: A — Create a role in Account B that trusts the instance role in Account A and grants the S3 permissions, then have the application call sts:AssumeRole and use the temporary credentials.

Cross-account access without stored secrets is exactly what role assumption is for: the trusting account defines the role and permissions, and the instance role assumes it through STS for short-lived credentials. Access keys in user data are long-lived secrets in plaintext. Security groups control network traffic and cannot reference IAM principals. Transfer Acceleration is a performance feature.

Correct answer: A — Enable API Gateway stage caching with a TTL, so repeated requests are served without invoking the backend.

Caching at the API Gateway stage returns responses for identical requests straight from the cache, which cuts both latency and the number of Lambda invocations you pay for — ideal for data that changes daily. More memory lowers duration but every request still invokes the function. Reserved concurrency caps or guarantees capacity without reducing cost. A VPC adds networking, not speed.

Correct answer: A — Create a global secondary index with `customerId` as the partition key and `orderDate` as the sort key.

A GSI can use a completely different partition and sort key, and it can be added to an existing table. A local secondary index must keep the table's partition key and can only be created when the table is created. Scanning reads every item, and recreating the table means a migration the question rules out.

Correct answer: A — Configure an S3 event notification for s3:ObjectCreated:* that invokes a Lambda function.

S3 event notifications invoke Lambda (or SNS/SQS/EventBridge) as objects are created, so processing happens within seconds and nothing runs while the bucket is idle. Polling costs money around the clock, and batch approaches add delay.

Correct answer: A — An API Gateway HTTP API

HTTP APIs are the cheaper, lower-latency option for straightforward proxying to Lambda. REST APIs cost more and exist for the richer feature set — API keys and usage plans, request validation, WAF, private endpoints — none of which is needed here. WebSocket APIs are for two-way connections.

Correct answer: A — Publish to an Amazon SNS topic with three Amazon SQS queues subscribed, one per system.

The fan-out pattern gives each consumer its own queue, so a slow or broken consumer only backs up its own queue and can retry independently. With one shared queue each message goes to a single consumer. Calling APIs in sequence couples the producer to all three systems.

Correct answer: A — An Amazon EventBridge rule with a cron schedule expression targeting the function.

EventBridge scheduled rules (or EventBridge Scheduler) support cron and rate expressions and invoke the function directly — serverless, with no infrastructure. Lambda has a 15-minute maximum runtime so loops cannot span days, SQS delays cap at 15 minutes, and an EC2 cron host is a server to maintain.

Correct answer: A — Enable DynamoDB Streams on the table and attach a Lambda function as an event source.

DynamoDB Streams captures item-level changes in order per partition key and Lambda can consume them within seconds. Polling misses deletes and intermediate states entirely. PITR is a backup feature, and an index does not deliver change events.

Correct answer: A — Lazy loading — data in the cache can become stale, and every cache miss costs an extra round trip.

Reading the cache first and filling it on a miss is lazy loading (cache-aside). Only requested data is cached, but entries go stale unless a TTL or an explicit invalidation is added, and the first request after a miss pays for both lookups. Write-through keeps the cache fresh at the cost of slower writes.

Correct answer: A — Publish the libraries as a Lambda layer and attach the layer to each function.

A layer is a shared archive that Lambda extracts into /opt for any function that references it, so shared code is deployed and versioned once. Downloading from S3 per invocation adds latency and cost to every call. The other options do not address packaging.

Correct answer: A — A Condition with `aws:MultiFactorAuthPresent` set to true

`aws:MultiFactorAuthPresent` is the global condition key that tests whether MFA was used for the request. `aws:SecureTransport` checks for TLS. Principal appears in resource-based policies rather than identity policies, and NotAction would allow everything except that action.

Correct answer: A — The application calls GenerateDataKey, encrypts the file locally with the plaintext data key, stores the encrypted data key alongside the file, and discards the plaintext key — envelope encryption.

KMS Encrypt is limited to 4 KB, so larger data uses envelope encryption: GenerateDataKey returns a plaintext key and an encrypted copy of it, you encrypt locally with the plaintext key, keep the encrypted key with the data, and decrypt it through KMS later. The AWS Encryption SDK and services such as S3 do this for you.

Correct answer: A — A resource-based policy on the Lambda function allowing s3.amazonaws.com to call lambda:InvokeFunction, with a source ARN condition.

The execution role controls what the function may do; a resource-based policy controls who may invoke it. For an S3 trigger you add a permission statement on the function for the S3 service principal, scoped by source ARN. The function separately needs s3:GetObject in its execution role to read the object.

Correct answer: A — Use CloudFront signed cookies, which grant access to multiple restricted files matching a path pattern.

Signed cookies are the documented answer when you want to grant access to many files at once and keep existing URLs unchanged; signed URLs are for individual files. IP restrictions break for mobile users, and obfuscated names in a public bucket are not access control.

Correct answer: A — Enable helpers for encryption in transit so the variable is encrypted with a customer managed KMS key and decrypted in code at runtime.

Lambda always encrypts environment variables at rest, but the console shows the decrypted value to anyone with GetFunctionConfiguration. Using a customer managed key with the encryption helpers keeps the stored value ciphertext, so it can only be read by a principal allowed to use the key. Base64 is encoding, not encryption.

Correct answer: A — The user signs in to a Cognito user pool; the app sends the ID or access token to a Cognito authorizer on the API.

A Cognito user pool authorizer validates the token API Gateway receives and passes the user claims to the backend, and tokens expire on their own. Embedding IAM keys in a mobile app leaks them. API keys identify an application for throttling, not a user, and a user ID in a query string can be set to anything.

Correct answer: A — As an output artifact stored in the pipeline's S3 artifact bucket, which the next action declares as its input artifact.

Actions exchange artifacts through the pipeline's S3 bucket: one action writes an output artifact and the next names it as an input. That is why the pipeline needs an artifact bucket and, for cross-account pipelines, a shared KMS key.

Correct answer: A — Use the AWS SAM CLI: `sam build`, then `sam local invoke` or `sam local start-api`.

The SAM CLI runs functions in a local container that mimics the Lambda runtime and can emulate API Gateway, so the feedback loop is seconds and the template is the one you deploy. Change sets preview infrastructure changes, not code behaviour.

Correct answer: A — appspec.yml in the root of the application revision bundle

CodeDeploy reads appspec.yml (appspec.yaml for ECS/Lambda) from the root of the revision to learn which files to copy where and which scripts to run at each lifecycle event. buildspec.yml belongs to CodeBuild.

Correct answer: A — Enable a canary release on the stage and set the percentage of traffic sent to the canary deployment.

API Gateway canary releases put a second deployment behind the same stage and send a configured percentage of requests to it, with separate metrics and logs, then promote the canary when it looks healthy. Weighted DNS is coarse and cached by resolvers, and deploying straight to the stage exposes all users at once.

Correct answer: A — The AWS Cloud Development Kit (AWS CDK), which synthesizes CloudFormation templates from code.

The CDK lets you write infrastructure in a general-purpose language and produces standard CloudFormation templates at synth time, so you keep drift detection, rollbacks and change sets. Shell scripts around the CLI are imperative with no state tracking.

Correct answer: A — Add configuration files with a .config extension in an .ebextensions directory in the source bundle.

.ebextensions configuration files are versioned with the application and applied by Beanstalk during deployment, so every new instance is configured identically. Manual SSH does not survive scaling, custom AMIs per change are slow, and buildspec.yml belongs to CodeBuild.

Correct answer: A — API Gateway's integration timeout is the limit being hit — return a job ID immediately and process asynchronously, then let the client poll or receive a notification.

API Gateway REST APIs have a maximum integration timeout (29 seconds by default), so any synchronous call longer than that fails at the gateway even though the function finishes. The pattern is to accept the request, do the work asynchronously, and let the client retrieve the result. Changing Lambda settings does not move the gateway's limit.

Correct answer: A — Run a CloudWatch Logs Insights query across the selected log groups, filtering on the order ID and using stats to group the results.

Logs Insights queries multiple log groups over a time range with filter and stats commands, which is exactly this task. Downloading logs is slow and manual. X-Ray shows latency and traces rather than log text, and a metric filter only applies to events arriving after it is created.

Correct answer: A — It is a hot partition — redesign the partition key to spread requests, for example by adding a random or calculated suffix.

Capacity is spread across partitions, so one very popular key can be throttled while the table looks idle overall. The fix is key design that distributes traffic; write sharding with a suffix is the documented technique. Strongly consistent reads consume more capacity, and an LSI shares the same partition key.

Correct answer: A — A Lambda function in a VPC has no internet access by default — add a gateway VPC endpoint for S3, or route the subnets through a NAT gateway.

Once a function runs in your VPC, its traffic follows your route tables, and private subnets have no path to the S3 public endpoint. A gateway endpoint for S3 is free and keeps the traffic on the AWS network; a NAT gateway also works but costs more. Lambda ENIs cannot use a public IP, so a public subnet does not help.