View Full Amazon AWS Certified Developer – Associate DVA-C02 Exam Dumps and Practice Test Dumps.

 

Question 301

A developer needs to ensure that a Lambda function can access resources in a private subnet while still being able to reach the internet for an external API call. Which configuration is required?

1. Attach an Internet Gateway directly to Lambda
2. Configure the Lambda function in a private subnet with a NAT Gateway
3. Attach a public IP address to the Lambda function
4. Configure an S3 Gateway Endpoint only

Correct Answer: 2

Explanation

When a Lambda function is connected to a VPC private subnet and needs outbound internet connectivity, the private subnet can route traffic through a NAT Gateway located in a public subnet. The public subnet uses an Internet Gateway for internet access. Lambda functions do not receive public IP addresses directly, and an Internet Gateway cannot provide direct internet access to resources in a private subnet. An S3 Gateway Endpoint is useful for private access to S3 but does not provide general internet connectivity. Therefore, a NAT Gateway is appropriate when a VPC-connected Lambda function needs to communicate with external internet-based services.

Question 302

A developer wants to encrypt sensitive application data before storing it in DynamoDB. Which AWS service can provide managed encryption keys for this purpose?

1. AWS Key Management Service
2. Amazon Route 53
3. Amazon CloudFront
4. Amazon SQS

Correct Answer: 1

Explanation

AWS Key Management Service, or AWS KMS, provides managed cryptographic keys that applications can use for encryption and decryption operations. Developers can use KMS keys directly through AWS SDK operations or integrate them with other AWS services that support encryption. KMS also provides access controls and auditing through AWS services such as CloudTrail. Route 53 manages DNS, CloudFront provides content delivery, and SQS provides message queuing. Using KMS allows an application to centralize key management while maintaining control over which IAM principals are permitted to use encryption keys.

Question 303

A developer needs to make an HTTP request from an application running on Amazon ECS to an internal service that is exposed through a private load balancer. Which networking configuration is appropriate?

1. Public DNS only
2. Internet Gateway only
3. VPC networking with appropriate security group rules
4. S3 bucket policy

Correct Answer: 3

Explanation

An ECS task communicating with an internal load balancer can use VPC networking because both resources can communicate through private network addresses. The security groups associated with the ECS task and load balancer must allow the required traffic on the appropriate ports. An Internet Gateway is not required for communication between private resources within the VPC. Public DNS is also unnecessary when the service is intentionally internal. An S3 bucket policy controls access to S3 objects and does not affect ECS-to-load-balancer communication. Proper VPC routing and security group configuration therefore provide the required connectivity.

Question 304

A developer needs to ensure that an SQS message remains available for processing if the consumer fails before deleting it. Which setting is important?

1. Message retention period only
2. Visibility timeout
3. Delivery delay only
4. Queue name

Correct Answer: 2

Explanation

SQS visibility timeout controls how long a message becomes temporarily invisible after a consumer receives it. If the consumer successfully processes the message, it should delete the message before the visibility timeout expires. If the consumer fails and does not delete the message, the message can become visible again for another processing attempt. The retention period determines how long messages remain in the queue before expiration, while delivery delay postpones initial availability. The queue name does not affect message redelivery behavior. Therefore, configuring an appropriate visibility timeout is important for reliable message processing.

Question 305

A developer wants to trigger a Lambda function whenever a new object is uploaded to an S3 bucket. Which configuration should be used?

1. S3 event notification
2. DynamoDB Stream
3. SQS redrive policy
4. API Gateway usage plan

Correct Answer: 1

Explanation

Amazon S3 event notifications can invoke Lambda functions when specific events occur in a bucket, such as object creation. The notification configuration can also use filters based on object key prefixes or suffixes to limit which objects trigger the function. DynamoDB Streams capture changes to DynamoDB items, SQS redrive policies manage failed messages, and API Gateway usage plans control API access and quotas. An S3 event notification is therefore the direct mechanism for triggering a Lambda function when an object is uploaded. Developers should also ensure that Lambda has permission to be invoked by the S3 bucket.

Question 306

A developer needs to process records from DynamoDB Streams using Lambda. Which AWS configuration connects the stream to the Lambda function?

1. Lambda event source mapping
2. Lambda function URL
3. API Gateway stage
4. CloudFront distribution

Correct Answer: 1

Explanation

A Lambda event source mapping connects supported event sources such as DynamoDB Streams to a Lambda function. Lambda polls the stream and invokes the function with batches of records. The event source mapping can be configured with settings such as batch size, starting position, and retry behavior. A Lambda function URL provides an HTTP endpoint and is unrelated to stream processing. API Gateway stages organize API deployments, while CloudFront distributes web content. Therefore, an event source mapping is the appropriate configuration for processing DynamoDB Stream records through Lambda.

Question 307

A developer wants to prevent a Lambda function from exceeding a specific level of concurrent executions. Which configuration should be used?

1. Lambda layers
2. Reserved concurrency
3. Lambda environment variables
4. Function URL

Correct Answer: 2

Explanation

Lambda reserved concurrency establishes a maximum number of concurrent executions for a specific function and also reserves that amount of concurrency for the function. This can prevent one function from consuming all available account concurrency and affecting other functions. Lambda layers provide reusable libraries and dependencies, environment variables provide configuration values, and function URLs expose functions through HTTP endpoints. Reserved concurrency is therefore appropriate when an application needs to control or limit the number of simultaneous executions of a particular Lambda function.

Question 308

A developer is using Amazon S3 and wants objects to be automatically moved to a lower-cost storage class after a defined period. Which feature should be configured?

1. S3 Lifecycle rule
2. S3 event notification
3. S3 access point policy only
4. S3 multipart upload

Correct Answer: 1

Explanation

S3 Lifecycle rules allow developers to automate object transitions between storage classes or configure object expiration. For example, objects that are accessed frequently at first can later be transitioned to a lower-cost storage class according to the application’s retention requirements. Event notifications are used to send events when bucket operations occur, access point policies control access, and multipart upload is designed for uploading large objects in multiple parts. Lifecycle rules are therefore the appropriate mechanism for automatically transitioning objects based on their age or other supported criteria.

Question 309

A developer wants to securely pass database credentials to an ECS task without embedding them directly in the container image. Which option is appropriate?

1. Store the credentials in the Dockerfile
2. Store the credentials in Amazon ECR image tags
3. Use AWS Secrets Manager and reference the secret from the task definition
4. Store the credentials in a public S3 object

Correct Answer: 3

Explanation

AWS Secrets Manager provides centralized storage for sensitive values such as database credentials. ECS task definitions can reference Secrets Manager secrets so that sensitive information does not need to be embedded in the container image or Dockerfile. The ECS task execution configuration must have the necessary permissions to retrieve the secret. Storing credentials in an image, image tags, or public storage exposes sensitive information and creates unnecessary security risks. Secrets Manager also supports secret rotation and controlled access through IAM policies, making it suitable for securely supplying credentials to containerized applications.

Question 310

A developer needs to invoke an AWS Lambda function directly from an HTTP client without managing an API Gateway REST API. Which Lambda capability can be used?

1. Lambda function URL
2. Lambda layer
3. Lambda alias only
4. Lambda destination

Correct Answer: 1

Explanation

Lambda function URLs provide an HTTPS endpoint directly associated with a Lambda function. They allow clients to invoke the function without requiring API Gateway. Developers can configure authentication options and resource-based permissions according to the application’s security requirements. Lambda layers provide shared dependencies, aliases provide named references to function versions, and destinations configure asynchronous invocation results. A function URL is therefore suitable when an application needs a straightforward HTTPS endpoint for invoking a Lambda function without introducing API Gateway into the architecture.

Question 311

A developer wants to send a message to multiple independent consumers whenever an application event occurs. Which AWS service provides a publish/subscribe model for this use case?

1. Amazon SNS
2. Amazon EBS
3. Amazon EFS
4. Amazon RDS

Correct Answer: 1

Explanation

Amazon SNS provides a publish/subscribe messaging model in which publishers send messages to topics and multiple subscribers can receive those messages. Subscribers can include SQS queues, Lambda functions, HTTP endpoints, and other supported destinations. This allows one event to be distributed to multiple independent consumers without the producer needing to manage each consumer directly. EBS and EFS provide storage capabilities, while RDS provides managed relational databases. SNS is therefore appropriate when an application needs fanout messaging and multiple consumers should independently receive the same published event.

Question 312

A developer needs an SQS queue to wait briefly before making newly sent messages available to consumers. Which setting should be configured?

1. Visibility timeout
2. Message retention
3. Delivery delay
4. Maximum message size

Correct Answer: 3

Explanation

SQS delivery delay controls how long newly sent messages remain unavailable to consumers after they are added to the queue. This can be useful when an application needs to postpone processing for a short period. Visibility timeout works differently: it temporarily hides a message after a consumer receives it. Message retention controls how long messages remain in the queue, while maximum message size controls the amount of data a message can contain. Therefore, delivery delay is the appropriate setting when an application needs to postpone the initial availability of newly sent SQS messages.

Question 313

A developer wants to reduce the number of API calls made when retrieving many objects from an AWS service that returns paginated results. What should the application implement?

1. Pagination handling
2. IAM role chaining
3. S3 versioning
4. Lambda layers

Correct Answer: 1

Explanation

Many AWS APIs return paginated results when a response could contain a large number of resources. Applications should inspect pagination tokens or continuation values and make subsequent requests until all required results are retrieved. AWS SDKs often provide paginator abstractions that simplify this process. Pagination does not necessarily reduce the number of requests required to retrieve every result, but it prevents applications from incorrectly assuming that one API response contains all available data and allows results to be processed incrementally. IAM role chaining, S3 versioning, and Lambda layers solve different problems and are unrelated to API result pagination.

Question 314

A developer needs to configure a Lambda function to use a specific version of a dependency without including the dependency in every deployment package. Which feature should be used?

1. Lambda layer
2. Lambda destination
3. EventBridge archive
4. API Gateway authorizer

Correct Answer: 1

Explanation

Lambda layers allow developers to package libraries, custom runtimes, or other shared dependencies separately from the function deployment package. A function can reference one or more layers, allowing common dependencies to be reused across multiple functions. This can reduce duplication and simplify dependency management. Lambda destinations control where asynchronous invocation results are sent, EventBridge archives retain events for replay, and API Gateway authorizers control API access. A Lambda layer is therefore appropriate when developers want to share a dependency across functions without packaging it separately into every function deployment artifact.

Question 315

A developer wants to prevent accidental deletion of an important S3 object while retaining the ability to access older versions of that object. Which combination can provide these capabilities?

1. S3 Versioning and appropriate protection controls
2. S3 Transfer Acceleration only
3. S3 event notifications only
4. CloudFront caching only

Correct Answer: 1

Explanation

S3 Versioning preserves multiple versions of an object, allowing previous versions to remain available when an object is overwritten or deleted. Additional S3 protection controls can be used when stronger safeguards against deletion are required. Transfer Acceleration improves transfer performance for supported uploads and downloads, while event notifications communicate bucket events to other services. CloudFront caching improves content delivery but does not provide object version protection. Therefore, S3 Versioning combined with appropriate protection mechanisms can help preserve historical object versions and reduce the impact of accidental changes or deletions.

Question 316

A developer needs to automatically retry a failed Lambda invocation from an asynchronous event source. Which AWS feature can be configured to send failed invocation results to another destination?

1. Lambda destinations
2. Lambda layers
3. API Gateway stages
4. S3 Transfer Acceleration

Correct Answer: 1

Explanation

Lambda destinations can route the result of asynchronous function invocations to supported destinations after processing succeeds or fails. For failures, developers can configure an on-failure destination such as an SQS queue, SNS topic, or another supported target. This provides a useful mechanism for capturing failed invocation results and enabling further processing or investigation. Lambda layers manage dependencies, API Gateway stages organize API deployments, and S3 Transfer Acceleration improves data transfer performance. Destinations therefore provide an appropriate mechanism for handling the outcome of asynchronous Lambda processing.

Question 317

A developer needs to monitor how many times a Lambda function has been invoked and create an alarm when the count exceeds a threshold. Which service should be used?

1. Amazon EventBridge
2. Amazon CloudWatch
3. Amazon Route 53
4. Amazon ECR

Correct Answer: 2

Explanation

Amazon CloudWatch collects Lambda metrics such as invocation counts, errors, duration, and throttles. Developers can create CloudWatch alarms based on these metrics and configure notifications or automated responses when thresholds are reached. EventBridge is primarily used for event routing and scheduled events, Route 53 provides DNS functionality, and ECR stores container images. CloudWatch is therefore the appropriate service for monitoring Lambda invocation metrics and creating threshold-based alarms. Combining CloudWatch metrics with alarms provides an effective way to detect unusual application behavior and operational conditions.

Question 318

A developer wants to allow an application to upload an object to S3 without giving the application long-term AWS credentials. Which mechanism should be generated?

1. S3 presigned URL
2. S3 bucket name only
3. CloudWatch dashboard
4. DynamoDB stream

Correct Answer: 1

Explanation

An S3 presigned URL grants temporary access to a specific S3 operation using credentials from the entity that generated the URL. A backend service can generate a presigned URL for an upload and return it to the client. The client can then upload the object directly to S3 without receiving the application’s long-term AWS credentials. This approach can reduce backend bandwidth usage and avoid exposing permanent credentials. A bucket name alone does not grant permission, while CloudWatch dashboards and DynamoDB Streams are unrelated to temporary S3 upload authorization.

Question 319

A developer needs to ensure that a DynamoDB item is updated only if its current value matches an expected value. Which feature should be used?

1. DynamoDB Scan
2. DynamoDB ConditionExpression
3. DynamoDB TTL
4. DynamoDB Stream

Correct Answer: 2

Explanation

DynamoDB ConditionExpression allows an application to specify conditions that must be true before a write operation succeeds. This is useful for optimistic concurrency control and preventing unintended overwrites. For example, an application can require a version attribute to have a specific value before updating an item. If the condition is false, DynamoDB rejects the write operation. Scan retrieves items across a table or index, TTL manages automatic expiration, and Streams capture changes. ConditionExpression is therefore the appropriate feature when an update should occur only when the existing item state meets a required condition.

Question 320

A developer wants to trace requests as they move through a distributed application containing API Gateway, Lambda, and other AWS services. Which AWS service should be enabled?

1. AWS X-Ray
2. Amazon S3
3. Amazon ECR
4. AWS CodeArtifact

Correct Answer: 1

Explanation

AWS X-Ray helps developers analyze and trace requests across distributed applications. It can provide a service map and trace information showing how requests move through supported components such as API Gateway, Lambda, and other AWS services. This can help identify latency, errors, and service dependencies. S3 provides object storage, ECR provides container image storage, and CodeArtifact provides package management. X-Ray is therefore the appropriate service when developers need distributed tracing to understand application request flows and diagnose performance or operational problems across multiple AWS components.