Practice Free DVA-C02 Exam Online Questions
A company recently deployed an AWS Lambda function. A developer notices an increase in the function throttle metrics in Amazon CloudWatch.
What are the MOST operationally efficient solutions to reduce the function throttling? (Select TWO.)
- A . Migrate the function to Amazon EKS.
- B . Increase the maximum age of events in Lambda.
- C . Increase the function’s reserved concurrency.
- D . Add the lambda: GetFunctionConcurrency action to the execution role.
- E . Request a service quota change for increased concurrency.
C,E
Explanation:
Lambda throttling occurs when the number of concurrent executions exceeds the available concurrency. This can happen due to account-level concurrency limits, function-level reserved concurrency limits, or sudden traffic spikes.
The most operationally efficient ways to reduce throttling are to increase available concurrency:
Option C: Increasing the function’s reserved concurrency can reduce throttling when the function is being constrained by a too-low reserved concurrency value. Reserved concurrency guarantees a fixed amount of concurrency for the function (and also caps it). If the cap is currently too low, raising it allows more parallel executions and reduces throttles.
Option E: If throttling is due to the account concurrency quota being reached (or burst scaling limits in some patterns), the correct fix is to request a service quota increase. This increases the total available concurrency capacity for the account (and/or specific dimensions), allowing more simultaneous executions across functions.
Why the others are not correct:
A (migrate to EKS) is high effort and not operationally efficient for solving Lambda throttling.
B (maximum age of events) applies to asynchronous event retries/queues; it does not reduce throttling―it only changes how long events remain eligible for processing.
D is irrelevant: adding lambda: GetFunctionConcurrency to the execution role only allows reading settings and does not change throttling behavior.
Therefore, the best operational fixes are to increase reserved concurrency and request a concurrency quota increase.
A developer has an application that makes batch requests directly to Amazon DynamoDB by using the BatchGetItem low-level API operation. The responses frequently return values in the UnprocessedKeys element.
Which actions should the developer take to increase the resiliency of the application when the batch response includes values in UnprocessedKeys? (Choose two.)
- A . Retry the batch operation immediately.
- B . Retry the batch operation with exponential backoff and randomized delay.
- C . Update the application to use an AWS software development kit (AWS SDK) to make the requests.
- D . Increase the provisioned read capacity of the DynamoDB tables that the operation accesses.
- E . Increase the provisioned write capacity of the DynamoDB tables that the operation accesses.
B,C
Explanation:
The UnprocessedKeys element indicates that the BatchGetItem operation did not process all of the requested items in the current response. This can happen if the response size limit is exceeded or if the table’s provisioned throughput is exceeded. To handle this situation, the developer should retry the batch operation with exponential backoff and randomized delay to avoid throttling errors and reduce the load on the table. The developer should also use an AWS SDK to make the requests, as the SDKs automatically retry requests that return UnprocessedKeys.
Reference: [BatchGetItem – Amazon DynamoDB]
[Working with Queries and Scans – Amazon DynamoDB]
[Best Practices for Handling DynamoDB Throttling Errors]
A developer is building an application on AWS. The application has an Amazon API Gateway API that sends requests to an AWS Lambda function. The API is experiencing increased latency because the Lambda function has limited available CPU to fulfill the requests.
Before the developer deploys the API into production, the developer must configure the Lambda function to have more CPU.
Which solution will meet this requirement?
- A . Increase the virtual CPU (vCPU) cores quota of the Lambda function.
- B . Increase the amount of memory that is allocated to the Lambda function.
- C . Increase the ephemeral storage size of the Lambda function.
- D . Increase the timeout value of the Lambda function.
B
Explanation:
In AWS Lambda, CPU power scales proportionally with the memory configuration. Lambda does not let you directly set “CPU cores” as a standalone setting in the general case; instead, increasing the function’s configured memory increases the CPU allocation (and other resources such as network throughput) available to the function. Therefore, to reduce latency caused by insufficient CPU, the developer should increase the function’s memory setting.
Option B directly addresses the CPU limitation in the supported Lambda configuration model. This is a common performance tuning approach: raise memory, benchmark, and find the optimal cost/performance point.
Option A is not the right lever for most Lambda functions because Lambda compute is configured via memory (and architecture), not by directly raising a “vCPU quota” per function in a typical tuning workflow.
Option C increases /tmp storage capacity and helps when dealing with large temporary files, not CPU availability.
Option D increases the maximum runtime allowed per invocation, but it does not give the function more CPU and will not reduce latency caused by CPU starvation.
Therefore, increasing the allocated memory is the correct way to increase CPU for a Lambda function.
A company uses an AWS Lambda function to perform natural language processing (NLP) tasks. The company has attached a Lambda layer to the function. The Lambda layer contain scientific libraries that the function uses during processing.
The company added a large, pre-trained text-classification model to the Lambda layer. The addition increased the size of the Lambda layer to 8.7 GB. After the addition and a recent deployment, the Lambda function returned a RequestEntityTooLargeException error.
The company needs to update the Lambda function with a high-performing and portable solution to
decrease the initialization time for the function.
Which solution will meet these requirements?
- A . Store the large pre-trained model in an Amazon S3 bucket. Use the AWS SDK to access the model.
- B . Create an Amazon EFS file system to store the large pre-trained model. Mount the file system to an Amazon EC2 instance. Configure the Lambda function to use the EFS file system.
- C . Split the components of the Lambda layer into five new Lambda layers. Zip the new layers, and attach the layers to the Lambda function. Update the function code to use the new layers.
- D . Create a Docker container that includes the scientific libraries and the pre-trained model. Update the Lambda function to use the container image.
D
Explanation:
Requirement Summary:
NLP Lambda function with a large pre-trained model
Lambda layer became 8.7 GB → Exceeds AWS limits
Function returns RequestEntityTooLargeException
Need: High-performing, portable, low initialization time
Important AWS Limits:
Lambda Layers size limit (combined across all layers): 250 MB (unzipped)
Deployment package size (unzipped): 250 MB
Lambda container image support allows up to 10 GB image size
Evaluate Options:
A: Store model in S3 and load during execution Leads to cold start latency every time
Model loading from S3 is slower and not suitable for real-time NLP
Not optimal for performance
B: Use EFS mounted to Lambda
⚠️ Valid for large models, but adds latency during cold start as model loads from EFS
Requires EFS setup, VPC, and has added network I/O overhead
Still slower than bundling in container image
C: Split into five Lambda layers
Still violates the total layer size limit of 250 MB (unzipped)
You cannot exceed that even with multiple layers
D: Use Docker container image
Allows bundling up to 10 GB of dependencies and models
High portability and performance
Avoids latency of downloading models at runtime
Ideal for scientific/NLP models
Lambda container image support: https: //docs.aws.amazon.com/lambda/latest/dg/images-create.html
Lambda limits: https: //docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.html
Using large models with Lambda: https: //aws.amazon.com/blogs/machine-learning/deploying-large-machine-learning-models-on-aws-lambda-with-container-images/
A developer needs to store configuration variables for an application. The developer needs to set an expiration date and time for me configuration. The developer wants to receive notifications. Before the configuration expires.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Create a standard parameter in AWS Systems Manager Parameter Store Set Expiation and Expiration Notification policy types.
- B . Create a standard parameter in AWS Systems Manager Parameter Store Create an AWS Lambda function to expire the configuration and to send Amazon Simple Notification Service (Amazon SNS) notifications.
- C . Create an advanced parameter in AWS Systems Manager Parameter Store Set Expiration and Expiration Notification policy types.
- D . Create an advanced parameter in AWS Systems Manager Parameter Store Create an Amazon EC2 instance with a corn job to expire the configuration and to send notifications.
C
Explanation:
This solution will meet the requirements by creating an advanced parameter in AWS Systems Manager Parameter Store, which is a secure and scalable service for storing and managing configuration data and secrets. The advanced parameter allows setting expiration and expiration notification policy types, which enable specifying an expiration date and time for the configuration and receiving notifications before the configuration expires. The Lambda code will be refactored to load the Root CA Cert from the parameter store and modify the runtime trust store outside the Lambda function handler, which will improve performance and reduce latency by avoiding repeated calls to Parameter Store and trust store modifications for each invocation of the Lambda function.
Option A is not optimal because it will create a standard parameter in AWS Systems Manager Parameter Store, which does not support expiration and expiration notification policy types.
Option B is not optimal because it will create a secret access key and access key ID with permission to access the S3 bucket, which will introduce additional security risks and complexity for storing and managing credentials.
Option D is not optimal because it will create a Docker container from Node.js base image to invoke Lambda functions, which will incur additional costs and overhead for creating and running Docker containers.
Reference: AWS Systems Manager Parameter Store, [Using SSL/TLS to Encrypt a Connection to a DB Instance]
In a move toward using microservices, a company’s management team has asked all development teams to build their services so that API requests depend only on that service’s data store. One team is building a Payments service which has its own database; the service needs data that originates in the Accounts database. Both are using Amazon DynamoDB.
What approach will result in the simplest, decoupled, and reliable method to get near-real time updates from the Accounts database?
- A . Use AWS Glue to perform frequent ETL updates from the Accounts database to the Payments
database. - B . Use Amazon ElastiCache in Payments, with the cache updated by triggers in the Accounts database.
- C . Use Amazon Data Firehose to deliver all changes from the Accounts database to the Payments database.
- D . Use Amazon DynamoDB Streams to deliver all changes from the Accounts database to the Payments database.
D
Explanation:
The goal is near-real-time propagation of changes from one DynamoDB table (Accounts) to another service’s datastore (Payments) while keeping services decoupled. The simplest and most reliable DynamoDB-native change feed is Amazon DynamoDB Streams.
DynamoDB Streams captures item-level modifications (inserts, updates, deletes) in time order and makes them available as a stream of change records. A consumer (commonly an AWS Lambda function) can process stream records and apply the necessary updates to the Payments database/table (or publish events for downstream processing). This provides near-real-time updates with minimal operational overhead, strong integration, and a decoupled architecture because the Accounts service simply emits changes and does not need to call Payments synchronously.
Option A (Glue ETL) is batch-oriented and adds heavy operational complexity; it’s not the simplest nor near-real-time.
Option B introduces a cache as a synchronization mechanism, which complicates consistency and durability; caches are not ideal as the primary propagation channel.
Option C (Firehose) is designed for delivering streaming data to destinations like S3, Redshift, OpenSearch, etc., and is not the standard approach for DynamoDB-to-DynamoDB change replication.
Therefore, DynamoDB Streams is the best fit for near-real-time, decoupled updates between DynamoDB-backed microservices.
A developer is working on an ecommerce platform that communicates with several third-party payment processing APIs The third-party payment services do not provide a test environment.
The developer needs to validate the ecommerce platform’s integration with the third-party payment processing APIs. The developer must test the API integration code without invoking the third-party payment processing APIs.
Which solution will meet these requirements’?
- A . Set up an Amazon API Gateway REST API with a gateway response configured for status code 200 Add response templates that contain sample responses captured from the real third-party API.
- B . Set up an AWS AppSync GraphQL API with a data source configured for each third-party API Specify an integration type of Mock Configure integration responses by using sample responses captured from the real third-party API.
- C . Create an AWS Lambda function for each third-party API. Embed responses captured from the real third-party API. Configure Amazon Route 53 Resolver with an inbound endpoint for each Lambda function’s Amazon Resource Name (ARN).
- D . Set up an Amazon API Gateway REST API for each third-party API Specify an integration request type of Mock Configure integration responses by using sample responses captured from the real third-party API
D
Explanation:
Mocking API Responses: API Gateway’s Mock integration type enables simulating API behavior without invoking backend services.
Testing with Sample Data: Using captured responses from the real third-party API ensures realistic testing of the integration code.
Focus on Integration Logic: This solution allows the developer to isolate and test the application’s interaction with the payment APIs, even without a test environment from the third-party providers.
Reference:
Amazon API Gateway Mock
Integrations: https: //docs.aws.amazon.com/apigateway/latest/developerguide/how-to-mock-integration.html
A company notices that credentials that the company uses to connect to an external software as a service (SaaS) vendor are stored in a configuration file as plaintext.
The developer needs to secure the API credentials and enforce automatic credentials rotation on a quarterly basis.
Which solution will meet these requirements MOST securely?
- A . Use AWS Key Management Service (AWS KMS) to encrypt the configuration file. Decrypt the configuration file when users make API calls to the SaaS vendor. Enable rotation.
- B . Retrieve temporary credentials from AWS Security Token Service (AWS STS) every 15 minutes. Use the temporary credentials when users make API calls to the SaaS vendor.
- C . Store the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access.
- D . Store the credentials in AWS Systems Manager Parameter Store and enable rotation. Retrieve the credentials when users make API calls to the SaaS vendor.
C
Explanation:
Store the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access. This is correct. This solution will meet the requirements most securely, because it uses a service that is designed to store and manage secrets such as API credentials. AWS Secrets Manager helps you protect access to your applications, services, and IT resources by enabling you to rotate, manage, and retrieve secrets throughout their lifecycle1. You can store secrets such as passwords, database strings, API keys, and license codes as encrypted values2. You can also configure automatic rotation of your secrets on a schedule that you specify3. You can use the AWS SDK or CLI to retrieve secrets from Secrets Manager when you need them4. This way, you can avoid storing credentials in plaintext files or hardcoding them in your code.
A developer is building an application that uses an Amazon RDS for PostgreSQL database. To meet security requirements, the developer needs to ensure that data is encrypted at rest. The developer must be able to rotate the encryption keys on demand.
- A . Use an AWS KMS managed encryption key to encrypt the database.
- B . Create a symmetric customer managed AWS KMS key. Use the key to encrypt the database.
- C . Create a 256-bit AES-GCM encryption key. Store the key in AWS Secrets Manager, and enable managed rotation. Use the key to encrypt the database.
- D . Create a 256-bit AES-GCM encryption key. Store the key in AWS Secrets Manager. Configure an AWS Lambda function to perform key rotation. Use the key to encrypt the database.
B
Explanation:
Why Option B is Correct: A customer-managed AWS Key Management Service (KMS) key allows for encryption at rest and provides the ability to rotate the key on demand. This ensures compliance with security requirements for key management and database encryption.
RDS integrates natively with AWS KMS, allowing the use of a customer-managed key for encrypting data at rest.
Key rotation can be managed directly in AWS KMS without needing custom solutions.
Why Other Options are Incorrect:
Option A: AWS KMS managed encryption keys (AWS-owned keys) do not support key rotation on
demand.
Option C & D: Storing keys in AWS Secrets Manager with custom rotation is not a recommended approach for database encryption. AWS KMS is designed specifically for secure key management and encryption.
AWS Documentation
Reference: Encrypting Amazon RDS Resources
AWS Key Management Service (KMS)
A developer is building a serverless application by using AWS Serverless Application Model (AWS SAM) on multiple AWS Lambda functions. When the application is deployed, the developer wants to shift 10% of the traffic to the new deployment of the application for the first 10 minutes after deployment. If there are no issues, all traffic must switch over to the new version.
Which change to the AWS SAM template will meet these requirements?
- A . Set the Deployment Preference Type to Canaryl OPercent10Minutes. Set the AutoPublishAlias property to the Lambda alias.
- B . Set the Deployment Preference Type to Linearl OPercentEveryIOMinutes. Set AutoPubIishAIias property to the Lambda alias.
- C . Set the Deployment Preference Type to Canaryl OPercentIOMinutes. Set the PreTraffic and PostTraffic properties to the Lambda alias.
- D . Set the Deployment Preference Type to Linearl OPercentEvery10Minutes. Set PreTraffic and PostTraffic properties to the Lambda alias.
A
Explanation:
The Deployment Preference Type property specifies how traffic should be shifted between versions of a Lambda function1. The Canary10Percent10Minutes option means that 10% of the traffic is immediately shifted to the new version, and after 10 minutes, the remaining 90% of the traffic is shifted1. This matches the requirement of shifting 10% of the traffic for the first 10 minutes, and then switching all traffic to the new version.
The AutoPublishAlias property enables AWS SAM to automatically create and update a Lambda alias that points to the latest version of the function1. This is required to use the Deployment Preference Type property1. The alias name can be specified by the developer, and it can be used to invoke the function with the latest code.
