Practice Free DVA-C02 Exam Online Questions
A developer is optimizing an AWS Lambda function and wants to test the changes in production on a small percentage of all traffic. The Lambda function serves requests to a REST API in Amazon API Gateway. The developer needs to deploy their changes and perform a test in production without changing the API Gateway URL.
Which solution will meet these requirements?
- A . Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Publish the API to the canary stage.
- B . Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Deploy a new API Gateway stage.
- C . Define an alias on the $LATEST version of the Lambda function. Update the API Gateway endpoint to reference the new Lambda function alias. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the SLAT EST version of the Lambda function. Publish to the canary stage.
- D . Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Deploy the API to the production API Gateway stage.
C
Explanation:
A Lambda alias is a pointer to a specific Lambda function version or another alias1. A Lambda alias allows you to invoke different versions of a function using the same name1. You can also split traffic between two aliases by assigning weights to them1.
In this scenario, the developer needs to test their changes in production on a small percentage of all traffic without changing the API Gateway URL. To achieve this, the developer can follow these steps:
Define an alias on the $LATEST version of the Lambda function. This will create a new alias that
points to the latest code of the function.
Update the API Gateway endpoint to reference the new Lambda function alias. This will make the API Gateway invoke the alias instead of a specific version of the function.
Upload and publish the optimized Lambda function code. This will update the $LATEST version of the function with the new code.
On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. This will enable API Gateway to perform a canary deployment on a new API2. A canary deployment is a software development strategy in which a new version of an API is deployed for testing purposes, and the base version remains deployed as a production release for normal operations on the same stage2. The canary release receives a small percentage of API traffic and the production release takes up the rest2.
Update the API Gateway endpoint to use the $LATEST version of the Lambda function. This will make the canary release invoke the latest code of the function, which contains the optimized changes.
Publish to the canary stage. This will deploy the changes to a subset of users for testing.
By using this solution, the developer can test their changes in production on a small percentage of all traffic without changing the API Gateway URL. The developer can also monitor and compare metrics between the canary and production releases, and promote or disable the canary as needed2.
A developer is troubleshooting an Amazon API Gateway API Clients are receiving HTTP 400 response errors when the clients try to access an endpoint of the API.
How can the developer determine the cause of these errors?
- A . Create an Amazon Kinesis Data Firehose delivery stream to receive API call logs from API Gateway.
Configure Amazon CloudWatch Logs as the delivery stream’s destination. - B . Turn on AWS CloudTrail Insights and create a trail Specify the Amazon Resource Name (ARN) of the trail for the stage of the API.
- C . Turn on AWS X-Ray for the API stage Create an Amazon CloudWatch Logs log group Specify the Amazon Resource Name (ARN) of the log group for the API stage.
- D . Turn on execution logging and access logging in Amazon CloudWatch Logs for the API stage. Create a CloudWatch Logs log group. Specify the Amazon Resource Name (ARN) of the log group for the API stage.
D
Explanation:
This solution will meet the requirements by using Amazon CloudWatch Logs to capture and analyze the logs from API Gateway. Amazon CloudWatch Logs is a service that monitors, stores, and accesses log files from AWS resources. The developer can turn on execution logging and access logging in Amazon CloudWatch Logs for the API stage, which enables logging information about API execution and client access to the API. The developer can create a CloudWatch Logs log group, which is a collection of log streams that share the same retention, monitoring, and access control settings. The developer can specify the Amazon Resource Name (ARN) of the log group for the API stage, which instructs API Gateway to send the logs to the specified log group. The developer can then examine the logs to determine the cause of the HTTP 400 response errors.
Option A is not optimal because it will create an Amazon Kinesis Data Firehose delivery stream to receive API call logs from API Gateway, which may introduce additional costs and complexity for delivering and processing streaming data.
Option B is not optimal because it will turn on AWS CloudTrail Insights and create a trail, which is a feature that helps identify and troubleshoot unusual API activity or operational issues, not HTTP response errors.
Option C is not optimal because it will turn on AWS X-Ray for the API stage, which is a service that helps analyze and debug distributed applications, not HTTP response errors.
Reference: [Setting Up CloudWatch Logging for a REST API], [CloudWatch Logs Concepts]
A developer is writing a web application that must share secure documents with end users. The documents are stored in a private Amazon S3 bucket. The application must allow only authenticated users to download specific documents when requested, and only for a duration of 15 minutes.
How can the developer meet these requirements?
- A . Copy the documents to a separate S3 bucket that has a lifecycle policy for deletion after 15 minutes.
- B . Create a presigned S3 URL using the AWS SDK with an expiration time of 15 minutes.
- C . Use server-side encryption with AWS KMS managed keys (SSE-KMS) and download the documents using HTTPS.
- D . Modify the S3 bucket policy to only allow specific users to download the documents. Revert the change after 15 minutes.
A developer is modifying a large-scale IoT application that stores device telemetry data in an Amazon DynamoDB table. The telemetry data is valuable only for a limited time, but the application stores the data indefinitely. Data storage is slowing the application down. The developer needs a solution to improve the performance of the application.
Which solution will meet this requirement in the MOST operationally efficient way?
- A . Create an AWS Lambda function to run an Amazon EventBridge job on a schedule to scan the DynamoDB table for old items and to delete them.
- B . Archive old data in an Amazon S3 bucket. Set up an S3 Lifecycle policy to transition old data to a more cost-effective storage class.
- C . Set a TTL attribute for the telemetry data. Activate TTL on the DynamoDB table.
- D . Change the table to on-demand capacity mode.
C
Explanation:
The most operationally efficient way to remove time-bound data from a DynamoDB table is to use Time to Live (TTL). TTL is a DynamoDB feature that lets you define an attribute (typically a Unix epoch timestamp) that represents an item’s expiration time. After the timestamp has passed, DynamoDB automatically marks the item as expired and later deletes it in the background. This directly satisfies the requirement because the telemetry is only valuable for a limited time, yet it is currently stored
indefinitely.
Enabling TTL (option C) improves performance and operational efficiency by preventing the table from growing without bounds. As the item count grows, access patterns that rely on scans, large partitions, or indexes can degrade, and storage-related overhead increases. TTL helps keep the dataset “fresh” by automatically removing stale telemetry, reducing the amount of data the application must work around and decreasing overall storage footprint.
Option A is operationally heavier: scanning and deleting items with a scheduled Lambda introduces ongoing maintenance, costs, and risk of throttling (table scans can be expensive and disruptive). It also requires custom logic, error handling, and retries.
Option B addresses cost optimization for archived data but does not fix the DynamoDB table size or the performance degradation caused by keeping old data in the table; archiving is useful, but you still need an efficient deletion mechanism from DynamoDB.
Option D (on-demand capacity mode) changes how capacity is managed, not how much data is stored; it does not remove stale items and therefore does not address the core problem.
Therefore, the best and most operationally efficient solution is C: add a TTL attribute to each telemetry item and enable TTL on the DynamoDB table so DynamoDB automatically expires and deletes old telemetry.
A company is building a micro services app1 cation that consists of many AWS Lambda functions. The development team wants to use AWS Serverless Application Model (AWS SAM) templates to automatically test the Lambda functions. The development team plans to test a small percentage of traffic that is directed to new updates before the team commits to a full deployment of the application.
Which combination of steps will meet these requirements in the MOST operationally efficient way? (Select TWO.)
- A . Use AWS SAM CLI commands in AWS CodeDeploy lo invoke the Lambda functions to lest the deployment
- B . Declare the EventlnvokeConfig on the Lambda functions in the AWS SAM templates with OnSuccess and OnFailure configurations.
- C . Enable gradual deployments through AWS SAM templates.
- D . Set the deployment preference type to Canary10Percen130Minutes Use hooks to test the deployment.
- E . Set the deployment preference type to Linear10PefcentEvery10Minutes Use hooks to test the deployment.
C,D
Explanation:
This solution will meet the requirements by using AWS Serverless Application Model (AWS SAM) templates and gradual deployments to automatically test the Lambda functions. AWS SAM templates are configuration files that define serverless applications and resources such as Lambda functions. Gradual deployments are a feature of AWS SAM that enable deploying new versions of Lambda functions incrementally, shifting traffic gradually, and performing validation tests during deployment. The developer can enable gradual deployments through AWS SAM templates by adding a Deployment Preference property to each Lambda function resource in the template. The developer can set the deployment preference type to Canary10Percent30Minutes, which means that 10 percent of traffic will be shifted to the new version of the Lambda function for 30 minutes before shifting 100 percent of traffic. The developer can also use hooks to test the deployment, which are custom Lambda functions that run before or after traffic shifting and perform validation tests or rollback actions.
Reference: [AWS Serverless Application Model (AWS SAM)], [Gradual Code Deployment]
A developer wants the ability to roll back to a previous version of an AWS Lambda function in the event of errors caused by a new deployment.
How can the developer achieve this with MINIMAL impact on users?
- A . Change the application to use an alias that points to the current version. Deploy the new version of the code Update the alias to use the newly deployed version. If too many errors are encountered, point the alias back to the previous version.
- B . Change the application to use an alias that points to the current version. Deploy the new version of the code. Update the alias to direct 10% of users to the newly deployed version. If too many errors are encountered, send 100% of traffic to the previous version
- C . Do not make any changes to the application. Deploy the new version of the code. If too many errors are encountered, point the application back to the previous version using the version number in the Amazon Resource Name (ARN).
- D . Create three aliases: new, existing, and router. Point the existing alias to the current version. Have the router alias direct 100% of users to the existing alias. Update the application to use the router alias. Deploy the new version of the code. Point the new alias to this version. Update the router alias to direct 10% of users to the new alias. If too many errors are encountered, send 100% of traffic to the existing alias.
A company is using an AWS Lambda function to process records from an Amazon Kinesis data stream. The company recently observed slow processing of the records. A developer notices that the iterator age metric for the function is increasing and that the Lambda run duration is constantly above normal.
Which actions should the developer take to increase the processing speed? (Choose two.)
- A . Increase the number of shards of the Kinesis data stream.
- B . Decrease the timeout of the Lambda function.
- C . Increase the memory that is allocated to the Lambda function.
- D . Decrease the number of shards of the Kinesis data stream.
- E . Increase the timeout of the Lambda function.
A,C
Explanation:
Increasing the number of shards of the Kinesis data stream will increase the throughput and parallelism of the data processing. Increasing the memory that is allocated to the Lambda function will also increase the CPU and network performance of the function, which will reduce the run duration and improve the processing speed.
Option B is not correct because decreasing the timeout of the Lambda function will not affect the processing speed, but may cause some records to fail if they exceed the timeout limit.
Option D is not correct because decreasing the number of shards of the Kinesis data stream will decrease the throughput and parallelism of the data processing, which will slow down the processing speed.
Option E is not correct because increasing the timeout of the Lambda function will not affect the processing speed, but may increase the cost of running the function.
Reference: [Amazon Kinesis Data Streams Scaling], [AWS Lambda Performance Tuning]
A company operates a web-based loan processing application. The application’s UI is implemented in JavaScript. The frontend transmits application data securely by using HTTPS to Amazon API Gateway, which invokes an AWS Lambda function in private subnets. The Lambda function interacts with third-party credit check APIs that require persistent API keys. The company enforces strict policies to ensure that personally identifiable information (PII) and sensitive credentials are never exposed in client code, request paths, headers, or logs. The company needs a solution to manage the API keys that the Lambda function must use.
Which solution will meet this requirement in the MOST secure way?
- A . Store the API keys as encrypted environment variables by using an AWS KMS key. Configure the execution role of the Lambda function to have permissions to securely decrypt the environment variables at runtime.
- B . Pass the API keys to the Lambda function by including the keys as URL query parameters in each HTTPS request. Rely on TLS for encryption of the payload and response. Use API Gateway logging controls to manage what query parameters are logged.
- C . Bundle the API keys inside the minified client-side JavaScript. Configure the web application to call the Lambda function by using an API Gateway HTTP API, cross-origin resource sharing (CORS) restrictions, domain allowlists, and frequent rotation.
- D . Store the API keys as resource metadata tags on the Lambda function. Configure the Lambda function to read its own tags at startup by using the AWS SDK. Use IAM conditions to control access to the keys when the function retrieves the tags.
A
Explanation:
The correct answer is A. For a Lambda-based application that must use third-party API keys while ensuring secrets never appear in client code, request URLs, headers, or logs, storing the keys as encrypted Lambda environment variables protected by AWS KMS is the most secure choice among the options given. AWS supports encryption at rest for Lambda environment variables, and the function’s execution role can be granted permission to decrypt those values at runtime. This keeps the secrets entirely on the server side and out of the browser and request path.
Option B is insecure because query string parameters are a poor location for secrets. Even when HTTPS is used, query parameters can still be exposed through logs, monitoring systems, browser history, proxies, or debugging tools.
Option C is clearly unacceptable because embedding secrets in client-side JavaScript exposes them to users. Obfuscation or minification does not provide security.
Option D is also not appropriate because AWS resource tags are not a secrets-management
mechanism and are not intended for storing confidential credentials.
From AWS security best practices, secrets should never be embedded in client applications and should be stored in protected server-side configuration with strong access controls. Although AWS Secrets Manager would often be the stronger real-world recommendation for rotating and retrieving secrets, it is not listed here. Among the available choices, KMS-encrypted Lambda environment variables best satisfy the requirements for confidentiality, controlled access, and avoiding accidental exposure in application logs or HTTP request elements.
Therefore, A is the most secure answer.
A developer is creating an AWS Lambda function that searches for Items from an Amazon DynamoDQ
table that contains customer contact information. The DynamoDB table items have the customers as the partition and additional properties such as customer -type, name, and job_title.
The Lambda function runs whenever a user types a new character into the customer_type text Input. The developer wants to search to return partial matches of all tne email_address property of a particular customer type. The developer does not want to recreate the DynamoDB table.
What should the developer do to meet these requirements?
- A . Add a global secondary index (GSI) to the DynamoDB table with customer-type input, as the partition key and email_address as the sort key. Perform a query operation on the GSI by using the begins with key condition expression with the email_address property.
- B . Add a global secondary index (GSI) to the DynamoDB table with email_address as the partition key and customer_type as the sort key. Perform a query operation on the GSI by using the begine_with key condition expresses with the email. Address property.
- C . Add a local secondary index (LSI) to the DynemoOB table with customer_type as the partition Key and email_address as the sort Key. Perform a quick operation on the LSI by using the begine_with Key condition expression with the email-address property.
- D . Add a local secondary index (LSI) to the DynamoDB table with job-title as the partition key and email_address as the sort key. Perform a query operation on the LSI by using the begins_with key condition expression with the email_address property.
A
Explanation:
The solution that will meet the requirements is to add a global secondary index (GSI) to the DynamoDB table with customer_type as the partition key and email_address as the sort key. Perform a query operation on the GSI by using the begins_with key condition expression with the email_address property. This way, the developer can search for partial matches of the email_address property of a particular customer type without recreating the DynamoDB table. The other options either involve using a local secondary index (LSI), which requires recreating the table, or using a different partition key, which does not allow filtering by customer_type.
Reference: Using Global Secondary Indexes in DynamoDB
A company is using the AWS Serverless Application Model (AWS SAM) to develop a social media application. A developer needs a quick way to test AWS Lambda functions locally by using test event payloads. The developer needs the structure of these test event payloads to match the actual events that AWS services create.
- A . Create shareable test Lambda events. Use these test Lambda events for local testing.
- B . Store manually created test event payloads locally. Use the sam local invoke command with the file path to the payloads.
- C . Store manually created test event payloads in an Amazon S3 bucket. Use the sam local invoke command with the S3 path to the payloads.
- D . Use the sam local generate-event command to create test payloads for local testing.
D
Explanation:
Comprehensive Detailed Step by Step Explanation with All AWS Developer
Reference: The AWS Serverless Application Model (SAM) includes features for local testing and debugging of AWS Lambda functions. One of the most efficient ways to generate test payloads that match actual AWS event structures is by using the sam local generate-event command.
sam local generate-event: This command allows developers to create pre-configured test event payloads for various AWS services (e.g., S3, API Gateway, SNS). These generated events accurately reflect the format that the service would use in a live environment, reducing the manual work required to create these events from scratch.
Operational Overhead: This approach reduces overhead since the developer does not need to manually create or maintain test events. It ensures that the structure is correct and up-to-date with the latest AWS standards.
Alternatives:
Option A suggests using shareable test events, but manually creating or sharing these events introduces more overhead.
Option B and C both involve manually storing and maintaining test events, which adds unnecessary complexity compared to using sam local generate-event.
AWS SAM CLI documentation
