AWS Developer Associate (DVA-C02) Practice Questions¶
40 scenario-based practice questions covering all exam domains.
Exam Domain Breakdown: - Domain 1: Development with AWS Services (32%) - 13 questions - Domain 2: Security (26%) - 10 questions - Domain 3: Deployment (24%) - 10 questions - Domain 4: Troubleshooting and Optimization (18%) - 7 questions
Cert page: exams/aws/associate/developer-dva-c02/
Domain 1: Development with AWS Services (32%)¶
Question 1¶
Scenario: A developer is building a serverless API that needs to validate request payloads before processing. The validation logic is complex and varies by endpoint. What's the most efficient approach?
A. Create a Lambda authorizer for validation B. Use API Gateway mapping templates to validate requests and reject bad payloads C. Use API Gateway request validation with JSON Schema D. Add validation code at the beginning of each Lambda function
Answer
**Correct: C** **Why:** API Gateway request validation with JSON Schema provides built-in validation before Lambda is invoked, reducing costs and latency. Custom Lambda code adds execution time and cost. Lambda authorizers are for authentication, not payload validation. Mapping templates transform data but aren't designed for complex validation. **Key Concept:** [API Gateway Request Validation](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-method-request-validation.html)Question 2¶
Scenario: A Lambda function processes messages from an SQS queue. During testing, some messages fail and are processed multiple times before going to the dead-letter queue. How can the developer ensure each message is processed only once?
A. Increase the batch size so that more messages are handled in each invocation and fewer redeliveries occur B. Decrease the visibility timeout so that failed messages return to the queue sooner and are retried quickly C. Enable a FIFO queue, which preserves ordering within each message group D. Implement idempotency using DynamoDB with conditional writes
Answer
**Correct: D** **Why:** Implementing idempotency using DynamoDB with conditional writes ensures that even if a message is delivered multiple times, the processing logic only executes once. FIFO queues provide ordering but don't prevent reprocessing on failure. Visibility timeout changes don't solve the idempotency problem. Batch size doesn't affect duplicate processing. **Key Concept:** [Lambda Idempotency](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html)Question 3¶
Scenario: A developer needs to store user session data that expires after 30 minutes of inactivity. The application has millions of users and requires sub-millisecond read latency. Which service should they use?
A. DynamoDB with TTL enabled, which reads in single-digit milliseconds and removes expired session items automatically B. RDS MySQL with scheduled cleanup, using an event that deletes sessions inactive for 30 minutes C. ElastiCache Redis with key expiration D. S3 with lifecycle policies, expiring session objects after a configured number of days
Answer
**Correct: C** **Why:** ElastiCache Redis provides sub-millisecond latency and native TTL support for automatic key expiration, making it ideal for session management. DynamoDB TTL can take up to 48 hours to delete expired items. RDS doesn't provide sub-millisecond latency. S3 is for object storage, not session data. **Key Concept:** [ElastiCache for Redis](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.html)Question 4¶
Scenario: A developer has a Lambda function that makes 100 parallel calls to an external API. The calls spend their time waiting on the network, and the full set takes about 20 seconds. The function fails at the default 3-second timeout. What should the developer do?
A. Use Provisioned Concurrency B. Increase the Lambda memory allocation so the function gets more CPU for the calls C. Rebuild the work as a Step Functions workflow that fans out the calls D. Raise the function timeout to 30 seconds
Answer
**Correct: D** **Why:** The function is stopped at the 3-second default timeout, and the calls need about 20 seconds. Raising the timeout fixes that (the maximum is 15 minutes). More memory adds CPU, which does not help when the function is waiting on the network. Provisioned Concurrency reduces cold starts, not run time. Step Functions adds complexity that is not needed. **Key Concept:** [Lambda Function Timeout](https://docs.aws.amazon.com/lambda/latest/dg/configuration-timeout.html)Question 5¶
Scenario: A developer needs to query a DynamoDB table by a non-key attribute. The queries are infrequent but need to return results quickly. What's the most cost-effective approach?
A. Use a Scan operation with a filter expression, which reads every item in the table B. Migrate to Amazon RDS C. Create a Global Secondary Index (GSI) D. Create a Local Secondary Index (LSI) on the existing table
Answer
**Correct: C** **Why:** A Global Secondary Index allows efficient queries on non-key attributes without scanning the entire table. Since queries are infrequent, the GSI cost is minimal. Scan operations are expensive and slow for large tables. LSI can only be created at table creation and requires the same partition key. Migrating to RDS is unnecessary overhead. **Key Concept:** [DynamoDB Global Secondary Indexes](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GSI.html)Question 6¶
Scenario: A developer's Lambda function needs to process records from a Kinesis stream. The function occasionally fails, causing the entire batch to be reprocessed. How can the developer improve this?
A. Enable enhanced fan-out so each consumer gets its own dedicated read throughput per shard B. Configure bisect batch on function error C. Configure an on-success destination that routes each processed batch to an SQS queue D. Increase the shard count so each shard carries fewer records per batch
Answer
**Correct: B** **Why:** Bisect batch on function error splits a failed batch in half and retries, isolating the problematic record. This prevents good records from being reprocessed repeatedly. Enhanced fan-out improves throughput, not error handling. Increasing shards doesn't help with batch failures. An on-success destination only reports batches that already succeeded, so it does nothing for the failing ones. **Key Concept:** [Lambda Event Source Mapping](https://docs.aws.amazon.com/lambda/latest/dg/with-kinesis.html)Question 7¶
Scenario: A developer is building a REST API with API Gateway and Lambda. They need to return a custom error response with specific headers when validation fails. What's the correct approach?
A. Configure a Lambda alias with error handling B. Use API Gateway Gateway Responses C. Use API Gateway request validators only D. Throw an exception in Lambda with the error details
Answer
**Correct: B** **Why:** Gateway Responses allow customization of error responses including status codes, headers, and body format for various error types. Throwing exceptions returns a generic 502 error. Lambda aliases don't affect error responses. Request validators trigger errors but don't customize the response format. **Key Concept:** [API Gateway Gateway Responses](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-gatewayResponse-definition.html)Question 8¶
Scenario: A developer needs to upload a 10GB file to S3 from a client application. The upload must be resumable if interrupted. What approach should they use?
A. Single PUT request with increased timeout B. S3 Transfer Acceleration C. AWS Transfer Family D. Multipart upload with presigned URLs
Answer
**Correct: D** **Why:** Multipart upload breaks large files into parts that can be uploaded independently and resumed if interrupted. Presigned URLs allow secure uploads from clients without AWS credentials. Single PUT is limited to 5GB and not resumable. Transfer Family is for SFTP/FTPS. Transfer Acceleration improves speed but doesn't enable resumable uploads. **Key Concept:** [S3 Multipart Upload](https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html)Question 9¶
Scenario: A developer needs to invoke a Lambda function asynchronously and process the result later. They want to automatically retry failed invocations and capture failures for analysis. What should they configure?
A. SQS queue as event source, with the function polling the queue and a dead-letter queue on the source B. Lambda Destinations with on-failure configuration C. SNS topic trigger that invokes the function and stores the invocation results for later analysis D. CloudWatch Events rule that schedules invocations and records each failure in a log group
Answer
**Correct: B** **Why:** Lambda Destinations allow routing async invocation results to different targets based on success or failure. This enables automatic retry handling and failure capture without additional infrastructure. SQS is for queue-based processing, not async invocation results. CloudWatch Events is for scheduling. SNS triggers invoke Lambda, not capture results. **Key Concept:** [Lambda Destinations](https://docs.aws.amazon.com/lambda/latest/dg/invocation-async.html#invocation-async-destinations)Question 10¶
Scenario: A developer is building a GraphQL API using AWS AppSync. They need to combine data from a DynamoDB table and an external REST API in a single query. What's the best approach?
A. Use a single DynamoDB resolver, since AppSync cannot reach an external REST API B. Create separate resolvers for each data source and combine them with a pipeline resolver in one query C. Use DynamoDB streams to sync the table's data into the external REST API's store D. Implement client-side data aggregation, with the app sending one query per data source
Answer
**Correct: B** **Why:** Pipeline resolvers in AppSync allow chaining multiple resolvers to combine data from different sources in a single GraphQL query. A single DynamoDB resolver cannot also call the REST API, because each resolver targets one data source. DynamoDB streams are for data replication, not query-time aggregation. Client-side aggregation defeats the purpose of GraphQL. **Key Concept:** [AppSync Pipeline Resolvers](https://docs.aws.amazon.com/appsync/latest/devguide/pipeline-resolvers.html)Question 11¶
Scenario: A developer's Lambda function makes API calls to a third-party service that has rate limits. During peak traffic, the function is throttled. How can the developer smooth out the request rate?
A. Add an SQS queue with controlled concurrency B. Implement exponential backoff in the Lambda code when calls fail C. Use Lambda Provisioned Concurrency D. Use Lambda reserved concurrency to cap parallel invocations of the function
Answer
**Correct: A** **Why:** An SQS queue with controlled Lambda concurrency limits the rate of requests to the external service, smoothing out bursts. Reserved concurrency limits function invocations but doesn't queue requests. Exponential backoff handles retries but doesn't prevent initial throttling. Provisioned Concurrency reduces cold starts, not request rate. **Key Concept:** [SQS as Lambda Event Source](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html)Question 12¶
Scenario: A developer needs to store application configuration that may change without redeploying the application. The configuration includes feature flags and API endpoints. What service should they use?
A. Secrets Manager B. Environment variables set in the function configuration C. AWS AppConfig, managed config D. S3 bucket with versioning, polled by the app
Answer
**Correct: C** **Why:** AWS AppConfig provides managed configuration with validation, gradual rollout, and instant updates without redeployment. Environment variables require redeployment. S3 requires custom polling logic. Secrets Manager is for sensitive data like credentials, not general configuration. **Key Concept:** [AWS AppConfig](https://docs.aws.amazon.com/appconfig/latest/userguide/what-is-appconfig.html)Question 13¶
Scenario: A developer needs to implement a fan-out pattern where a single event triggers multiple independent Lambda functions. Order of execution doesn't matter. What's the simplest approach?
A. EventBridge Scheduler on a timer B. Step Functions parallel state C. SQS queue with multiple consumers D. SNS topic with multiple Lambda subscribers
Answer
**Correct: D** **Why:** SNS provides native fan-out where a single message triggers all subscribers simultaneously. It's simpler than Step Functions for independent parallel execution. EventBridge Scheduler fires on a timer, not in response to the event. SQS delivers each message to only one consumer, not suitable for fan-out. **Key Concept:** [SNS Fan-out Pattern](https://docs.aws.amazon.com/sns/latest/dg/sns-common-scenarios.html)Domain 2: Security (26%)¶
Question 14¶
Scenario: A developer needs to allow a Lambda function to access a DynamoDB table in another AWS account. What's the most secure approach?
A. Use VPC peering between the accounts so the function can reach the DynamoDB endpoint privately B. Configure a cross-account IAM role and assume it C. Make the DynamoDB table public so that any principal, including the other account, can call it D. Use hardcoded access keys from the other account, stored in the function's environment variables
Answer
**Correct: B** **Why:** Cross-account IAM roles allow secure access without sharing credentials. The Lambda function assumes the role in the other account using STS. Hardcoded keys are a security anti-pattern. Public DynamoDB tables don't exist. VPC peering doesn't grant IAM permissions. **Key Concept:** [Cross-Account Access](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html)Question 15¶
Scenario: A developer needs to securely store database credentials that a Lambda function uses. The credentials must be rotated automatically every 30 days. Which service should they use?
A. AWS Secrets Manager with rotation enabled through a built-in Lambda rotation function B. Environment variables with KMS encryption C. S3 bucket with server-side encryption D. Systems Manager Parameter Store SecureString
Answer
**Correct: A** **Why:** AWS Secrets Manager provides automatic rotation for database credentials with built-in Lambda rotation functions. Parameter Store SecureString doesn't have built-in rotation. Environment variables require redeployment to rotate. S3 is not designed for secrets management. **Key Concept:** [Secrets Manager Rotation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html)Question 16¶
Scenario: A developer is implementing authentication for an API Gateway REST API. The API needs to validate JWT tokens issued by a third-party identity provider. What's the recommended approach?
A. API Gateway JWT authorizer (HTTP API), configured with the identity provider's issuer and audience B. Lambda authorizer that validates the JWT C. Cognito User Pool authorizer, pointed at the third-party provider's token endpoint D. IAM authorization, with SigV4 signed requests created from the JWT claims
Answer
**Correct: B** **Why:** For REST APIs with third-party JWTs, a Lambda authorizer provides full control over token validation. HTTP API's built-in JWT authorizer doesn't work with REST APIs. IAM authorization is for AWS credentials. Cognito authorizers work with Cognito-issued tokens, not third-party tokens. **Key Concept:** [Lambda Authorizers](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html)Question 17¶
Scenario: A developer needs to encrypt sensitive data in a DynamoDB table with an AWS KMS key that is dedicated to this application. The team must control the key policy and rotation. What should they use?
A. DynamoDB default encryption with an AWS owned key B. Client-side encryption with a self-managed key C. The AWS managed key for DynamoDB, which is shared by every DynamoDB table in the account D. A customer managed key in AWS KMS, with its own key policy and rotation settings
Answer
**Correct: D** **Why:** A customer managed key lives in your account, can be dedicated to one application, and you control its key policy and rotation. AWS owned keys cannot be viewed or managed. The AWS managed key (aws/dynamodb) is shared by every table in the account and its permissions cannot be changed. A self-managed client-side key adds work and does not use KMS. **Key Concept:** [DynamoDB Encryption at Rest](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/encryption.howitworks.html)Question 18¶
Scenario: A developer's Lambda function needs to access resources in a private VPC subnet. After configuring VPC access, the function can no longer reach the internet to call external APIs. What should the developer do?
A. Configure a NAT Gateway in a public subnet and route the function's private subnets through it to the internet B. Disable VPC access for the Lambda function, which also removes its access to the private resources C. Add an Internet Gateway to the VPC and attach it to the private subnets used by the function D. Add a public IP to the Lambda function so that it can call external APIs directly
Answer
**Correct: A** **Why:** Lambda functions in a VPC private subnet need a NAT Gateway to access the internet. The NAT Gateway should be in a public subnet with a route to an Internet Gateway. Internet Gateway alone doesn't help private subnets. Disabling VPC access loses private resource connectivity. Lambda functions can't have public IPs. **Key Concept:** [Lambda VPC Networking](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html)Question 19¶
Scenario: A developer wants to ensure that only their specific Lambda function can write to an S3 bucket. What's the most secure way to implement this?
A. Resource-based policy on Lambda B. S3 ACL with canonical user ID of the function owner C. S3 bucket policy with principal condition D. IAM policy attached to the Lambda execution role, granting s3:PutObject
Answer
**Correct: C** **Why:** An S3 bucket policy with a principal condition restricting access to the specific Lambda execution role ARN ensures only that function can write. IAM policy grants the function access but doesn't prevent other principals from accessing the bucket. ACLs are legacy and less flexible. Resource-based policies on Lambda control who can invoke it, not what it can access. **Key Concept:** [S3 Bucket Policies](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html)Question 20¶
Scenario: A developer needs to implement fine-grained access control for a DynamoDB table where users can only read their own records. The application uses Cognito for authentication. What should they use?
A. DynamoDB streams with filtering, so each user's changes are delivered only to that user's records B. DynamoDB IAM policies with conditions, attached to a single role shared by every user with no identity mapping C. Cognito Identity Pool with IAM role mapping D. Lambda authorizer on API Gateway, which checks callers but does not scope direct DynamoDB item access
Answer
**Correct: C** **Why:** Cognito Identity Pool can map authenticated users to IAM roles with policies that use DynamoDB condition keys (like `dynamodb:LeadingKeys`) to restrict access to items matching the user's identity. This provides fine-grained access control at the IAM level. Lambda authorizers only guard API Gateway routes and do not limit what a caller can read directly from DynamoDB. DynamoDB streams are for change data capture. **Key Concept:** [Fine-Grained Access Control](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html)Question 21¶
Scenario: A developer needs to call AWS services from an EC2 instance. The security team prohibits storing credentials on instances. What's the correct approach?
A. Use AWS CLI configure B. Use environment variables set on the instance C. Store credentials in Secrets Manager D. Use an IAM instance profile
Answer
**Correct: D** **Why:** IAM instance profiles allow EC2 instances to assume a role and get temporary credentials automatically. No credentials are stored on the instance. Environment variables would require storing credentials. Secrets Manager adds complexity for this use case. CLI configure stores credentials in files. **Key Concept:** [IAM Roles for EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html)Question 22¶
Scenario: A developer is building a public API that needs to be protected against common web exploits like SQL injection and cross-site scripting. What AWS service should they use?
A. Security Groups B. AWS Shield C. AWS WAF, which inspects web requests D. Network ACLs
Answer
**Correct: C** **Why:** AWS WAF provides protection against web exploits including SQL injection and XSS through managed rules and custom rules. Shield protects against DDoS attacks. Security Groups and Network ACLs filter network traffic but don't inspect application-layer content. **Key Concept:** [AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html)Question 23¶
Scenario: A developer must keep sensitive values in Lambda environment variables. The values must be protected by a KMS key the team controls, and the code decrypts them at runtime. What should they do?
A. Keep the values encrypted in the package and decrypt with a key embedded in the function B. Enable KMS encryption on the deployment package, which also covers environment variables C. Move the values to AWS Secrets Manager and remove the environment variables from the function entirely, so no KMS key is needed D. Set a customer managed KMS key on the function, enable the encryption helpers, and decrypt in code
Answer
**Correct: D** **Why:** Lambda always encrypts environment variables at rest with a KMS key, and a customer managed key gives the team control of it. The console encryption helpers encrypt values client-side for protection in transit, and the code decrypts them with KMS at runtime. Secrets Manager is a good store but would remove the environment variables the scenario keeps. A key embedded in the function defeats KMS. Package encryption does not cover environment variables. **Key Concept:** [Securing Lambda Environment Variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars-encryption.html)Domain 3: Deployment (24%)¶
Question 24¶
Scenario: A developer wants to deploy a new version of a Lambda function with minimal risk. They want to gradually shift traffic to the new version while monitoring for errors. What should they use?
A. Blue/green deployment with separate functions B. Lambda versions with an alias that points fully at the new version C. Canary deployment with CodeDeploy and alarms for rollback D. All-at-once deployment
Answer
**Correct: C** **Why:** CodeDeploy with Lambda supports canary deployments that shift a small percentage of traffic initially, then complete the shift if no errors occur. An alias pointed fully at the new version moves all traffic at once. Blue/green with separate functions adds operational overhead. All-at-once is risky. **Key Concept:** [Lambda Deployment with CodeDeploy](https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-configurations.html#deployment-configurations-lambda)Question 25¶
Scenario: A developer needs to deploy a containerized application to ECS. The deployment should replace instances gradually with automatic rollback if health checks fail. What deployment type should they configure?
A. In-place deployment B. Rolling update, replacing tasks gradually C. Canary deployment, which shifts traffic between two task sets behind a CodeDeploy-managed load balancer D. Blue/green deployment, which keeps a full second task set and cuts traffic over
Answer
**Correct: B** **Why:** ECS rolling updates replace tasks gradually while maintaining availability. If health checks fail, the deployment rolls back automatically. Blue/green creates a new task set (more complex). In-place isn't an ECS concept. Canary also runs a second task set and shifts traffic through CodeDeploy, which is more setup than a gradual replacement. **Key Concept:** [ECS Deployment Types](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/deployment-types.html)Question 26¶
Scenario: A developer wants to use AWS SAM to define a serverless application. They need to configure environment-specific values like database endpoints. What's the best approach?
A. Use SAM parameter overrides with different files per environment B. Hardcode values in template.yaml C. Use Lambda environment variables only D. Create separate template files per environment
Answer
**Correct: A** **Why:** SAM supports parameter overrides using `--parameter-overrides` with different values per environment. This keeps a single template with environment-specific configurations. Hardcoding prevents reuse. Separate templates cause drift. Lambda environment variables don't handle all template configurations. **Key Concept:** [SAM Parameter Overrides](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-cli-command-reference-sam-deploy.html)Question 27¶
Scenario: A developer needs to automate the deployment pipeline for a Lambda function. The pipeline should run unit tests, build the code, and deploy to staging and production environments with approval between stages. What service should they use?
A. CodePipeline with CodeBuild and manual approval actions B. CodeBuild only, which runs the tests and builds and then deploys to staging and production C. GitHub Actions only, deploying straight to the environments with no AWS-native service D. Jenkins on EC2, which the team installs, patches, and scales itself
Answer
**Correct: A** **Why:** CodePipeline orchestrates the full deployment workflow including CodeBuild for testing/building, manual approval actions for stage gates, and deployment actions. CodeBuild alone doesn't provide workflow orchestration. Jenkins requires self-management. GitHub Actions alone lacks native AWS deployment integration. **Key Concept:** [CodePipeline](https://docs.aws.amazon.com/codepipeline/latest/userguide/welcome.html)Question 28¶
Scenario: A developer is using Elastic Beanstalk to deploy an application. They want to add custom configuration like installing additional packages and running scripts during deployment. What should they use?
A. .ebextensions configuration files in the application bundle, which install packages and run commands during deployment B. User data scripts, which run once when each instance first launches C. CodeDeploy hooks, which run lifecycle scripts around an application revision D. Custom AMI, with the packages baked in and rebuilt for every change
Answer
**Correct: A** **Why:** .ebextensions configuration files allow customizing Elastic Beanstalk environments including packages, files, commands, and services. Custom AMI requires ongoing maintenance. User data runs only at instance launch. CodeDeploy hooks aren't used with Elastic Beanstalk. **Key Concept:** [Elastic Beanstalk Configuration](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/ebextensions.html)Question 29¶
Scenario: A developer needs to deploy infrastructure and application code together. The infrastructure includes a Lambda function, DynamoDB table, and API Gateway. What tool should they use?
A. AWS Systems Manager Automation, which runs runbooks on existing resources B. AWS CLI scripts C. AWS CDK, defining stacks in code D. CloudFormation only
Answer
**Correct: C** **Why:** AWS CDK allows defining infrastructure and application code in the same project using familiar programming languages. It synthesizes to CloudFormation. Plain CloudFormation requires YAML/JSON. Systems Manager Automation runs runbooks on existing resources and does not define new infrastructure. CLI scripts lack state management and idempotency. **Key Concept:** [AWS CDK](https://docs.aws.amazon.com/cdk/v2/guide/home.html)Question 30¶
Scenario: A developer is deploying a containerized application. They want to use infrastructure as code but the team prefers YAML over programming languages. What should they use for container orchestration?
A. EKS with kubectl commands run by hand in a terminal B. AWS CDK with TypeScript C. ECS with CloudFormation templates D. Custom Docker scripts
Answer
**Correct: C** **Why:** ECS with CloudFormation uses YAML templates to define container services declaratively. Hand-run kubectl commands are not infrastructure as code. CDK uses programming languages. Custom scripts lack the benefits of infrastructure as code. **Key Concept:** [ECS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_ECS.html)Question 31¶
Scenario: A developer needs a place outside Lambda to store and version ZIP deployment packages. They want to keep multiple versions and roll back if needed. What should they use?
A. S3 bucket with versioning enabled B. Lambda layers C. CodeCommit repository D. ECR repository, which holds container images but cannot hold a ZIP deployment package
Answer
**Correct: A** **Why:** S3 with versioning stores deployment packages with version history, enabling rollbacks. CodeCommit stores source code, not built packages. Lambda layers are for shared dependencies. ECR is for container images, not Lambda ZIP packages. **Key Concept:** [Lambda Deployment Package](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html)Question 32¶
Scenario: A developer wants to test Lambda functions locally before deploying. They need to simulate API Gateway events and DynamoDB interactions. What tool should they use?
A. Docker compose B. AWS SAM CLI with sam local invoke C. LocalStack D. Unit tests with mocks only
Answer
**Correct: B** **Why:** SAM CLI's sam local invoke and sam local start-api allow testing Lambda functions locally with simulated AWS events. It integrates with Docker for the Lambda runtime. LocalStack is third-party. Docker compose doesn't simulate AWS services. Mocks don't test actual Lambda behavior. **Key Concept:** [SAM CLI Local Testing](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-cli-command-reference-sam-local-invoke.html)Question 33¶
Scenario: A developer needs to share common code between multiple Lambda functions without including it in each deployment package. What's the recommended approach?
A. Use a monorepo with shared modules B. Create a shared Lambda layer C. Use Lambda extensions D. Deploy the code to S3 and download at runtime
Answer
**Correct: B** **Why:** Lambda layers allow packaging shared libraries and dependencies separately from function code. Functions can include up to 5 layers. Extensions are for monitoring/security tools. Downloading from S3 adds latency. Monorepos help with development but don't reduce package size. **Key Concept:** [Lambda Layers](https://docs.aws.amazon.com/lambda/latest/dg/chapter-layers.html)Domain 4: Troubleshooting and Optimization (18%)¶
Question 34¶
Scenario: A developer notices that their Lambda function has high latency during the first invocation after periods of inactivity. Subsequent invocations are fast. What's causing this and how can they fix it?
A. Cold start; use Provisioned Concurrency B. Network latency; use VPC endpoints C. Timeout settings; increase the timeout to the maximum D. Memory limits; increase memory allocation for the function
Answer
**Correct: A** **Why:** Cold starts occur when Lambda needs to initialize a new execution environment. Provisioned Concurrency keeps environments warm, eliminating cold starts. VPC endpoints don't affect cold starts. Memory affects execution speed, not initialization. Timeout doesn't reduce latency. **Key Concept:** [Lambda Provisioned Concurrency](https://docs.aws.amazon.com/lambda/latest/dg/provisioned-concurrency.html)Question 35¶
Scenario: A developer's API Gateway returns 502 errors intermittently. The backend Lambda function logs show successful executions. What's the most likely cause?
A. Lambda function timeout, since a slow response makes API Gateway return an error B. VPC connectivity issues between API Gateway and the function's subnet C. API Gateway throttling when requests exceed the account's rate limit D. Response format not matching API Gateway integration
Answer
**Correct: D** **Why:** API Gateway returns 502 when the Lambda response format doesn't match expected structure (missing statusCode, headers, or body). Successful Lambda logs confirm execution completed. Timeout would show in Lambda logs. Throttling returns 429. VPC issues would cause Lambda failures. **Key Concept:** [API Gateway 502 Errors](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-known-issues.html)Question 36¶
Scenario: A developer needs to trace requests through an application with Lambda functions, API Gateway, and DynamoDB. They want to visualize the request flow and identify bottlenecks. What service should they use?
A. CloudWatch Metrics B. CloudWatch Logs Insights, a query language for log data C. AWS Config D. AWS X-Ray, for distributed tracing
Answer
**Correct: D** **Why:** X-Ray provides distributed tracing across AWS services, showing request flow, latency breakdown, and bottlenecks in a service map. CloudWatch Logs shows log data. CloudWatch Metrics shows aggregate data. AWS Config tracks configuration changes. **Key Concept:** [AWS X-Ray](https://docs.aws.amazon.com/xray/latest/devguide/aws-xray.html)Question 37¶
Scenario: A developer's DynamoDB table is experiencing throttling during peak hours. The table uses on-demand capacity mode. What should they investigate first?
A. Global Secondary Index throttling B. DynamoDB stream configuration C. Insufficient read/write capacity units D. Partition key design causing hot partitions
Answer
**Correct: D** **Why:** Even with on-demand capacity, DynamoDB can throttle hot partitions if a single partition receives disproportionate traffic. Poor partition key design (like using a date) causes this. On-demand mode auto-scales capacity units. GSI throttling is separate but also related to hot keys. Streams don't cause read/write throttling. **Key Concept:** [DynamoDB Partitions](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp-partition-key-design.html)Question 38¶
Scenario: A developer needs to find Lambda function errors, group them by log pattern, and get alerted on new error patterns. What should they use?
A. CloudWatch Application Insights B. CloudWatch Contributor Insights C. Lambda Insights, which collects function-level metrics such as duration, memory and error counts D. CloudWatch Logs anomaly detection on the function's log group, with an alarm on anomalies
Answer
**Correct: D** **Why:** CloudWatch Logs anomaly detection learns the normal patterns in a log group and flags new or unusual ones as anomalies, and you can alarm on them. Lambda Insights gives function metrics, not errors grouped by pattern. Contributor Insights ranks top contributors for fields you define but does not detect new patterns. Application Insights monitors application stacks. **Key Concept:** [CloudWatch Logs Anomaly Detection](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection.html)Question 39¶
Scenario: A developer's Lambda function is running out of memory. They see "Process exited before completing request" in the logs. The function processes images from S3. What should they do?
A. Increase Lambda memory, which also adds CPU B. Enable Lambda SnapStart C. Use S3 Transfer Acceleration D. Increase Lambda timeout
Answer
**Correct: A** **Why:** "Process exited before completing request" typically indicates the function ran out of memory. Image processing is memory-intensive. Increasing memory also increases CPU proportionally. Timeout doesn't help memory issues. Transfer Acceleration speeds downloads. SnapStart reduces cold starts. **Key Concept:** [Lambda Memory Configuration](https://docs.aws.amazon.com/lambda/latest/dg/configuration-memory.html)Question 40¶
Scenario: A developer notices an SQS-triggered Lambda function is processing messages slowly. The function takes 10 seconds per message, 1000 messages are queued, and the function's reserved concurrency is set to 5, so invocations are throttled. How can they improve throughput?
A. Decrease visibility timeout so messages become visible sooner B. Raise the function's reserved concurrency so more instances run in parallel C. Increase batch size so each invocation gets more messages D. Use FIFO queue to guarantee ordering and exactly-once processing across the whole queue
Answer
**Correct: B** **Why:** Reserved concurrency caps how many instances of the function can run, so the limit of 5 is the bottleneck. Raising it lets the SQS event source mapping scale out and process more messages at once. A larger batch still takes 10 seconds per message. FIFO queues limit throughput. Decreasing visibility timeout risks duplicate processing. **Key Concept:** [Scaling SQS Event Source Mappings](https://docs.aws.amazon.com/lambda/latest/dg/services-sqs-scaling.html)Answer Key¶
| Question | Answer | Domain |
|---|---|---|
| 1 | C | Development |
| 2 | D | Development |
| 3 | C | Development |
| 4 | D | Development |
| 5 | C | Development |
| 6 | B | Development |
| 7 | B | Development |
| 8 | D | Development |
| 9 | B | Development |
| 10 | B | Development |
| 11 | A | Development |
| 12 | C | Development |
| 13 | D | Development |
| 14 | B | Security |
| 15 | A | Security |
| 16 | B | Security |
| 17 | D | Security |
| 18 | A | Security |
| 19 | C | Security |
| 20 | C | Security |
| 21 | D | Security |
| 22 | C | Security |
| 23 | D | Security |
| 24 | C | Deployment |
| 25 | B | Deployment |
| 26 | A | Deployment |
| 27 | A | Deployment |
| 28 | A | Deployment |
| 29 | C | Deployment |
| 30 | C | Deployment |
| 31 | A | Deployment |
| 32 | B | Deployment |
| 33 | B | Deployment |
| 34 | A | Troubleshooting |
| 35 | D | Troubleshooting |
| 36 | D | Troubleshooting |
| 37 | D | Troubleshooting |
| 38 | D | Troubleshooting |
| 39 | A | Troubleshooting |
| 40 | B | Troubleshooting |