Free DVA-C03 practice test: 30 questions with answers

A dead-letter queue receives messages that exceed the configured receive count, so the main queue keeps flowing and the failures can be examined later. Timeouts and concurrency do not isolate failing messages, and SNS fan-out is a publishing pattern.

A Query on the partition key reads only that customer's items, and results come back in sort-key order. A Scan reads the whole table, BatchGetItem needs every key in advance, and a status index does not match the access pattern.

Request validation in API Gateway checks the body against a model and returns an error before the backend runs. Caching, usage plans, and WAF rules do not validate request structure.

Provisioned concurrency keeps a set number of environments initialized so requests avoid cold starts. Reserved concurrency only caps how many run, and timeouts and dead-letter queues do not affect initialization.

A strongly consistent read returns the most recent write, while eventually consistent reads may briefly return older data. Scans and batch reads are retrieval methods, not consistency guarantees.

SNS fan-out delivers each event to every subscribed queue, and each queue buffers independently for its consumer. A shared queue lets consumers compete for messages, so each event is handled only once.

Wait for callback pauses the execution until the approval system returns the task token with a result. Polling wastes invocations, and Express workflows are designed for short executions.

DAX is a managed in-memory cache for DynamoDB that returns cached reads with microsecond latency, and it keeps the same API. Redshift, Athena, and EFS do not cache DynamoDB reads.

Fargate runs container tasks without the team managing EC2 instances, while ECS handles scheduling. Athena, RDS, and Snowball do not run application containers.

CodeDeploy automates application deployments to EC2, on-premises servers, Lambda, and ECS, with rolling and blue/green strategies. Glue is for data integration, Macie for sensitive data discovery, and Budgets for cost tracking.

CodePipeline models the release process as stages and actions and calls CodeBuild and CodeDeploy as needed. Kinesis handles streaming data, Backup protects data, and Route 53 provides DNS.

By default CloudFormation rolls the stack back to its last stable state when an operation fails, unless rollback is disabled. Deleting everything or leaving the stack unrecoverable are not the defaults.

CodeDeploy supports Lambda traffic shifting with canary or linear configurations and can roll back automatically when linked alarms go into alarm state. The other options have no automated traffic shift or rollback.

CloudFormation provisions and manages resources from declarative templates as stacks. Athena queries data, Budgets tracks spend, and QuickSight builds dashboards.

Amazon ECR stores container images with versioning and access control, and ECS and EKS pull images from it. S3 Glacier is archival storage, EBS is block storage, and Lightsail is a simple hosting service.

The buildspec file lists the install, pre-build, build, and post-build commands for CodeBuild. The appspec file belongs to CodeDeploy, and pom.xml is a Maven build definition.

AWS X-Ray collects traces and service maps so the latency of each segment can be seen. Config, Budgets, and Macie address configuration, cost, and data discovery respectively.

CloudWatch Logs Insights runs queries across one or more log groups to find and aggregate matching entries. S3 Select queries objects, not log groups, and Macie and Config do not search logs.

Reserved concurrency caps the maximum concurrent executions for one function and guarantees it capacity from the account pool. Memory, timeout, and log retention do not control how many executions run at once.

Duration and Errors show how long invocations run and how often they fail, which pinpoints timeouts. The other metrics belong to databases, storage, or EC2 instances that this function does not use.

CloudTrail records management and, when enabled, data API calls with the caller identity, so the failing call can be identified. Polly, Inspector, and Trusted Advisor do not record API history.

Hot partitions come from requests concentrating on a few partition key values, so a key with more distinct values spreads the load. Application instance size, Lambda memory, and retries do not change how DynamoDB distributes items.

X-Ray shows where time and errors occur across the request path, and CloudWatch Logs contain the stack traces for failures. Disabling or deleting logs removes the evidence, and a larger package does not diagnose intermittent failures.

A Cognito identity pool exchanges identity-provider tokens for scoped, temporary AWS credentials. Shared users, root keys, and hard-coded keys are long-lived and unsafe.

Least privilege means granting only the action needed on the specific resource. Administrator, wildcard, and root access each grant far more than a read of one prefix requires.

Secrets Manager stores secrets encrypted with KMS, controls access with IAM, and supports managed rotation for supported databases. S3 versioning, plain-text variables, and CloudTrail do not manage credential rotation.

An instance profile supplies temporary credentials through the instance metadata service, so no long-lived keys are stored on the machine. Keys in AMIs, root keys, and shared users are long-lived and widely exposed.

SSE-KMS with a customer managed key lets the company control key policies and rotation, and KMS logs key usage in CloudTrail. SSE-S3 uses keys that AWS manages, and storing passwords in code is unsafe.

A resource-based policy on the function grants invoke permission to specific principals, including cross-account ones. Security groups, NACLs, and route tables control network traffic, not IAM authorization to invoke.

A Cognito user pool authorizer validates the token on each request before the integration runs. IP lists, shared passwords, and usage plans do not verify user identity tokens.