DVA-C02 Exam Dumps - AWS Certified Developer - Associate

The correct answer is B because Amazon CloudWatch Logs Insights is the AWS-native tool for interactively searching, filtering, and analyzing log data that is already stored in CloudWatch Logs. In this case, the developer needs to investigate intermittent Lambda failures within a specific 1-hour period , identify logs related to failures, and capture the timestamps of those failures. Logs Insights is purpose-built for exactly this kind of operational troubleshooting.

AWS documentation describes Logs Insights as a fully integrated log analytics capability that can query log groups by time range and pattern. The developer can run a query that filters for error-related log messages, extracts timestamp fields, and sorts the results to find exactly when failures occurred. This is highly efficient because it does not require exporting logs, writing custom parsing scripts, or manually browsing through streams.

Option A is possible but not the most operationally efficient. Browsing logs through the CLI is slower and more manual, especially for intermittent failures. Option C is inefficient because downloading logs to a local machine adds unnecessary steps and operational overhead. Option D can work for large-scale analytics, but exporting to S3 and querying with Athena is more complex than needed for logs that are already in CloudWatch Logs.

Therefore, the best solution is to use CloudWatch Logs Insights to query the Lambda log group for failure patterns and timestamps. This provides fast, targeted, and operationally efficient troubleshooting directly within AWS.

To test an updated Lambda integration without impacting production traffic, the key is to isolate test requests from the production stage that real users call. In API Gateway, a stage represents a deployed snapshot of an API configuration, and each stage has its own invoke URL . Creating a separate test stage provides immediate traffic isolation because production users continue using the production stage URL, while the developer tests using the test stage URL.

Using stage variables is a common API Gateway pattern to parameterize integrations per stage. For Lambda backends, stage variables can reference different Lambda function ARNs, aliases, or versions (depending on the integration style), allowing the same API resources and methods to route to different backends per stage. This lets the developer deploy and validate the updated Lambda function only in the test stage while keeping the production stage pointing to the stable Lambda version. The result is operationally efficient: minimal duplicated infrastructure, clear separation, and easy rollback by switching stage variables or redeploying only the stage configuration.

Option A (canary on the existing stage) intentionally shifts a percentage of production traffic to the new version, which violates the requirement that testing must not affect any production users. Option B (private endpoint) changes network accessibility and can break production access; it also does not provide safe version testing. Option D (clone entire stack) can work but has higher operational overhead (duplicate resources, additional deployment management) than using native stage isolation.

Therefore, C best meets the requirements: create a new test stage , use stage variables to point that stage to the updated Lambda function, and test safely using the test stage URL while production remains unaffected.

When sharing SSE-KMS–encrypted S3 objects across AWS accounts , AWS documentation states that three elements are required:

A customer-managed KMS key (Option E), because AWS-managed keys cannot be shared across accounts.

An S3 bucket policy (Option B) that grants the second account permission to access the objects.

A KMS key policy (Option C) that explicitly allows the second account to use the KMS key for decrypt operations.

Option A is incorrect because AWS-managed KMS keys cannot be shared. Option F uses SSE-S3, which does not use KMS and violates the encryption requirement. Option D is irrelevant because cross-account access does not require an S3 service role.

Therefore, the correct combination is B, C, and E .

Comprehensive and Detailed Step-by-Step Explanation:

Issue Analysis:

The stream uses service name as the partition key. This can cause " hot partition " issues when a few service names generate significantly more logs compared to others, causing uneven distribution of data across shards.

Metrics show that the write capacity used is below provisioned capacity, which confirms that the throughput errors are due to shard-level limits and not overall capacity.

Option C: Change Partition Key to Creation Timestamp:

By changing the partition key to the creation timestamp (or a composite key including timestamp), the distribution of data across shards can be randomized, ensuring an even spread of records.

This resolves the shard overutilization issue and eliminates ProvisionedThroughputExceededException.

Why Other Options Are Incorrect:

Option A: Switching to on-demand capacity mode might temporarily alleviate the issue, but the root cause (hot partitioning) remains unresolved.

Option B: Adding shards increases capacity but does not fix the skewed data distribution caused by using the service name as the partition key.

Option D: Creating separate streams for each service adds unnecessary complexity and does not scale well as the number of services grows.

If a bucket policy denies delete operations for all principals, but objects are still being removed, the most likely cause is S3 Lifecycle configuration. Lifecycle expiration is an S3-managed action that deletes objects automatically based on rules (such as “expire after N days”). These deletions occur as part of the S3 service’s lifecycle management and are not “someone calling DeleteObject” in the usual way from an IAM principal. As a result, developers often observe objects disappearing even though bucket policies deny deletes.

Therefore, to prevent additional deletions, the developer should review and remove (or modify) any Lifecycle rules that expire or transition/delete objects. This directly stops S3 from automatically deleting the log files.

Option A would not help if the policy already denies deletes and no explicit allow is causing the issue. Also, a deny overrides allow anyway.

Option C is unrelated: access points do not bypass bucket policies.

Option D is unlikely and not the primary control plane mechanism for automated S3 deletions. EventBridge can trigger workflows, but the direct, common AWS-native mechanism for periodic deletion is Lifecycle expiration.

Therefore, removing S3 Lifecycle expiration rules prevents further deletions.

Reserved concurrency guarantees a specific number of concurrent executions for a critical Lambda function. This ensures that the critical function always has sufficient resources to execute, even if other functions are consuming concurrency.

Why Option A:

Ensures Function Availability: Reserved concurrency isolates the critical Lambda function from other functions.

Low Overhead: Configuring reserved concurrency is straightforward and requires minimal setup.

Why Not Other Options:

Option B: Provisioned concurrency is ideal for reducing cold starts, not for managing execution limits.

Option C & D: Alarms and re-invocation mechanisms add complexity without resolving the root cause.

Managing Concurrency for AWS Lambda