AWS Certified Developer - Associate (DVA-C02)

S3 Object Lock is a data protection/compliance feature that prevents deletion or modification of objects for a retention period (WORM). It does not control CloudFront caching or force edge locations to re-fetch updated objects. In fact, Object Lock could hinder overwriting objects depending on retention settings, making it unrelated and potentially harmful for this deployment scenario.

An S3 lifecycle policy to delete previous versions (or noncurrent versions) affects storage management and cost, not CloudFront edge caches. Even if old versions are removed from S3, CloudFront can still serve the previously cached object until its TTL expires or an invalidation occurs. Lifecycle policies also operate on a schedule, not as an immediate post-deploy cache refresh mechanism.

Changing the CloudFront origin bucket after each deployment is an anti-pattern. It adds operational complexity, risks misconfiguration, and does not align with standard CI/CD practices. While it could force CloudFront to fetch from a different origin, it’s unnecessary and disruptive compared to invalidations or versioned asset filenames. It also doesn’t scale well and can break permissions, OAC/OAI settings, and DNS behavior.

Lambda environment variables are static per function configuration and updating them requires a function configuration update (often paired with publishing a new version/alias update). CodeDeploy AllAtOnce is the opposite of a canary and increases blast radius. This also couples config changes to Lambda deployments and does not provide a controlled 10% over 20 minutes rollout for configuration-only changes.

Using CDK/CloudFormation to manage parameters and redeploy on each change ties operational parameter updates to infrastructure deployments. While CodeDeployDefault.LambdaCanary10Percent15Minutes provides canary for Lambda version traffic shifting, it still requires publishing new versions and updating aliases, which violates the requirement to apply changes without redeploying function code and adds unnecessary deployment complexity for simple runtime limits.

Polling S3 every 5 minutes and programmatically updating Lambda environment variables introduces delay, complexity, and failure modes (missed updates, race conditions). Updating environment variables triggers function configuration changes and typically requires publishing new versions/CodeDeploy actions, which is effectively a redeployment path. It also does not provide a native, reliable canary rollout of configuration changes across invocations comparable to AppConfig deployment strategies.

Incorrect. AWS CloudTrail does not track CPU utilization metrics; it logs API calls and account activity for governance, compliance, and auditing. You cannot create a meaningful “CloudTrail alarm” for CPUUtilization because the data source is wrong. For operational metrics and thresholds, CloudWatch (not CloudTrail) is the correct service.

Incorrect. A cron job running aws ssm describe-instance-information does not provide CPU utilization and is not a reliable monitoring approach. It also adds operational burden, requires instance credentials/permissions, and can fail if the instance is unhealthy (exactly when you most need monitoring). CloudWatch already collects CPU metrics without custom scripts.

Incorrect. CloudTrail logs do not contain CPUUtilization metrics, so scanning them with Lambda cannot detect sustained CPU thresholds. Even if metrics were available elsewhere, polling and custom evaluation logic every 10 minutes is unnecessary and less robust than CloudWatch Alarms, which natively handle evaluation periods, missing data behavior, and alarm state transitions.

A Lambda authorizer is used with Amazon API Gateway to control access to API methods. It does not grant the Lambda function permissions to call S3 APIs. The function’s ability to read from S3 is governed by its execution role IAM policies (and possibly the bucket policy), not by an authorizer. This option confuses request authorization for APIs with service-to-service IAM permissions.

You cannot attach an S3 bucket policy “to the Lambda function.” Bucket policies are resource-based policies attached to the S3 bucket. While a bucket policy could grant the Lambda execution role access, it’s not the cleanest or most typical approach for same-account access in SAM, and it’s easy to over-permit. The question asks how to configure the SAM template to grant read-only access, which is best done on the function role.

SQS is a queue (not a topic), and it is unrelated to granting read permissions on S3 objects. You could use S3 event notifications to send messages to SQS when objects are created, but that does not authorize the Lambda function to read the objects. IAM permissions are still required for s3:GetObject (and possibly s3:ListBucket). This option mixes event-driven ingestion with access control.

Changing from Regional to Edge-Optimized affects how clients reach API Gateway (CloudFront distribution in front) and can improve latency for global users, but it does not change the required Lambda proxy response format. Endpoint type mismatches or CloudFront issues typically show different symptoms (DNS/403/5xx at edge), not a consistent 502 caused by a malformed integration response after Lambda succeeds.

For a GET /shipments/{trackingId}, there is typically no request body. The request clearly reached API Gateway and invoked the Lambda function (as evidenced by Lambda logs). A malformed client payload would more likely cause a 400 (bad request) or mapping/template errors before invocation, not a 502 after Lambda returns. The core issue is the response format, not the request.

Authorization issues (missing/invalid credentials) are handled by API Gateway before invoking Lambda and typically result in 401 Unauthorized or 403 Forbidden, not a 502. The evidence shows Lambda was invoked and completed successfully, so the request was authorized to reach the integration. The problem occurs when API Gateway tries to interpret the Lambda output, not when authenticating the caller.

Incorrect. SQS plus a custom consumer can detect >2000 ms values, but it introduces operational overhead: you must build, deploy, scale, and monitor the consumer, handle failures, retries, and poison messages. This is not the least-ops solution when CloudWatch alarms can natively evaluate thresholds and trigger SNS notifications.

Incorrect. An alarm on the average over 1 minute can miss single slow authorizations because the average may remain below 2000 ms even if one request exceeds 2 seconds. It also uses SES, which is not the standard service for CloudWatch alarm notifications (SNS is). This fails the “any single authorization” requirement.

Incorrect. Kinesis is unnecessary and adds operational complexity and cost for this use case. Also, CloudWatch alarms do not evaluate “any stream value” inside Kinesis records directly; you would still need a consumer (Lambda/KCL) to extract values and publish a metric. That defeats the least operational overhead requirement compared to direct CloudWatch custom metrics.

Incorrect. AWS Lambda does not support mounting arbitrary “snapshots” of dependencies as a filesystem in the way EC2 can use EBS snapshots. Lambda provides /tmp ephemeral storage and optional EFS mounting, but not snapshot mounting. This option describes a non-existent Lambda feature and would not be a valid deployment approach for oversized dependencies.

Incorrect. Although arm64 can sometimes provide better price/performance and may change dependency footprint, the question explicitly states the function uses x86_64 and that it must remain unchanged. Therefore, switching architectures violates a hard requirement. Additionally, changing architecture can introduce compatibility issues for native libraries like OpenCV/SciPy.

Incorrect. Lambda cannot attach an Amazon EBS volume. EBS is an EC2 block storage service and requires an EC2 instance to attach. For Lambda, the supported network filesystem option is Amazon EFS (and only within a VPC), but even EFS is not the best fit here compared to container images for packaging large dependencies.

Incorrect. AWS CodeDeploy is designed for deploying applications to EC2, Lambda, or ECS and coordinating deployment hooks, not for CI unit testing and rich test report visualization. Publishing results as CloudWatch metrics does not create a navigable JUnit-style report for auditors, and it would require additional tooling/dashboards to interpret detailed per-test-case results. It also couples unit testing to deployments, which is not a best practice for fast feedback CI.

Incorrect. Amazon CodeWhisperer is an AI coding assistant, not a CI system. It does not orchestrate builds on commits, run unit tests at scale, or provide standardized test report visualization. Storing raw outputs in S3 alone does not meet the requirement for a navigable JUnit-style report without building a UI; you would still need a viewer or reporting layer to interpret and browse results.

Incorrect. Lambda is not appropriate for compiling/building typical microservices and running full unit test suites due to execution time limits, dependency/tooling complexity, and ephemeral storage constraints. Storing results in a Lambda layer is not a durable, queryable, auditor-friendly retention mechanism and does not provide a navigable JUnit report UI. This approach would effectively require building and maintaining custom CI/reporting plumbing.

RDS + ElastiCache for Redis with lazy loading can achieve low latency, but lazy loading inherently risks stale reads (cache is refreshed on demand or via TTL). Meeting “never see stale data” requires explicit write-through updates or invalidation on every write/delete, plus careful handling of race conditions. Operational overhead is higher (cache-aside logic, invalidation, potential thundering herd) than using DAX with DynamoDB.

An in-process memory cache with lazy loading is operationally risky for a global, scaled service. Each application instance has its own cache, so updates/deletes won’t propagate instantly across the fleet, causing stale data. Achieving coherency would require a distributed invalidation mechanism (pub/sub, messaging) and careful coordination, increasing complexity and still not guaranteeing microsecond p95 across all instances.

DAX only works with DynamoDB; it cannot accelerate Amazon RDS. Also, “configure a TTL on the DAX cluster” is not how DAX consistency is achieved—TTL-based expiration would still allow stale reads until expiry and does not satisfy immediate update/delete requirements. This option is architecturally invalid and mixes incompatible services.

Migrating to DynamoDB violates key constraints: the team cannot change the database engine and cannot modify the database structure. Moving a 5-year relational analytics dataset with complex SQL views to DynamoDB would require significant re-modeling, query rewrites, and likely pre-aggregation. It also increases project risk and time-to-value compared to caching, and it is not “minimal management overhead” for this scenario.

Memcached on EC2 can cache responses, but it is self-managed: you must handle instance sizing, scaling policies, patching, failures, and cache warm-up behavior. This conflicts with the requirement to minimize management overhead. Additionally, ElastiCache provides a managed caching layer with better operational simplicity and built-in features (monitoring, maintenance) compared to running Memcached yourself on EC2.

DynamoDB Accelerator (DAX) only works in front of Amazon DynamoDB tables to accelerate DynamoDB reads. It cannot be placed in front of Amazon RDS for PostgreSQL and does not accelerate SQL queries or views. This option is a common exam trap: DAX is not a generic database cache and is not compatible with RDS engines.

Incorrect. AWS X-Ray focuses on distributed tracing (latency breakdowns, service maps, traces/segments) and can provide insights into request paths and downstream calls. It does not collect OS-level metrics like memory utilization, swap usage, filesystem utilization, or disk I/O at 1-minute granularity. X-Ray also is not the standard mechanism for ingesting arbitrary custom metrics such as cacheHitRate and queueDepth into CloudWatch.

Incorrect. Modifying the application to publish metrics via the AWS SDK could work for custom application metrics, but it requires code changes and does not inherently provide OS-level metrics like memory, swap, and filesystem utilization. You would still need an agent or additional host instrumentation to gather those OS metrics. This approach increases development effort and risk compared to using the CloudWatch agent’s built-in capabilities.

Incorrect. AWS CloudTrail records AWS API calls for governance, compliance, and auditing (who did what, when, from where). It does not capture per-instance OS performance metrics or custom application metrics. CloudTrail logs are useful for security investigations and change tracking, not for right-sizing based on CPU/memory/disk utilization or for monitoring application-level KPIs like cacheHitRate and queueDepth.

Creating a new Lambda alias does not update the function’s code package. Aliases are pointers to published versions and are used for traffic shifting, stable ARNs, and deployment strategies (e.g., blue/green with CodeDeploy). If the underlying function code is not updated (or a new version is not published), a new alias won’t cause CloudFormation to pull a new ZIP from S3.

Uploading to a different bucket is unnecessary and does not inherently solve the problem unless the template is also updated to reference that new bucket/key/version. The core issue is CloudFormation not seeing a change in the Lambda Code definition. Changing buckets adds operational complexity and is not the recommended mechanism for deterministic deployments.

A code-signing configuration enforces that Lambda only deploys code signed by trusted publishers, improving supply-chain security. It does not force CloudFormation to redeploy code when the S3 key remains the same. Even with code signing, CloudFormation still requires a change in S3Key or S3ObjectVersion (or equivalent) to trigger an update.

Amazon SQS is a message queue optimized for decoupling producers and consumers with at-least-once delivery, but it uses a competing-consumer model: once a message is consumed and deleted, other consumers cannot read it. You could duplicate messages to multiple queues or use SNS-to-SQS fanout, but that explicitly duplicates the pipeline per consumer and complicates replay/checkpointing semantics compared to a true stream.

Amazon Kinesis Data Firehose is a fully managed delivery service that buffers and delivers streaming data to destinations like S3, Redshift, and OpenSearch. It is not designed for multiple EC2-based applications to concurrently consume the same stream with sub-second latency and independent checkpoint/replay. Firehose focuses on delivery with buffering (seconds to minutes) and transformation, not multi-consumer real-time processing.

Amazon EventBridge is an event bus for routing events to targets with filtering and SaaS integration. While it supports multiple targets, it is not a streaming service with shard-based throughput, ordered records, and consumer-controlled checkpoints. EventBridge also does not provide the same stream replay model (per-consumer resume from sequence checkpoints) required for crash recovery and near-real-time stream processing at scale.

Incorrect. The CloudWatch agent is used for publishing OS/application metrics and logs to Amazon CloudWatch. CodeDeploy does not require the CloudWatch agent to perform deployments or evaluate deployment success. While CloudWatch can help with troubleshooting (e.g., viewing logs/metrics during a rollout), its absence would not directly cause CodeDeploy to fail with HEALTH_CONSTRAINTS.

Incorrect. If the developer’s IAM user lacked codedeploy:CreateDeployment, the deployment would fail to start and would be denied immediately by IAM. The scenario describes a rollout that began and then aborted at 6 minutes due to health constraints, which indicates instance-level deployment execution/health issues rather than a caller authorization problem.

Incorrect. There is no universal requirement to enable a special “CodeDeploy health checks” feature for every deployment group. CodeDeploy health behavior is driven by deployment configurations (minimum healthy hosts, batch size) and optional integrations like load balancers and alarms. HEALTH_CONSTRAINTS is typically caused by real instance failures or insufficient healthy capacity, not by a missing mandatory feature toggle.

Incorrect. It only filters on action="normalize" and does not restrict service="rates-pipeline", so it could include normalize events from other services. It also aggregates by bin(1s) (1-second intervals) rather than the required 1-minute intervals, producing far more granular and noisy results than requested. Even though the stats functions are correct, the filter and bin size do not meet the question requirements.

Incorrect. While it correctly filters on service and action and uses bin(1m), it swaps the meanings of fastest and slowest by labeling max(latency_ms) as fastest_ms and min(latency_ms) as slowest_ms. In latency measurements, the fastest request corresponds to the minimum latency, and the slowest corresponds to the maximum latency. This is a common exam trick focused on careful interpretation of min/max.

Incorrect in context. It uses parse @message "normalize completed in * ms" to extract latency_ms, which is only necessary if the logs are unstructured text. The question states each JSON log event already includes an integer field latency_ms, so parsing is unnecessary and may fail if the message format differs. It also does not filter on service and action, so it could include unrelated events that match the parsed pattern.

Systems Manager Parameter Store SecureString can store sensitive values and can be shared across accounts in some scenarios by using resource policies on advanced parameters. However, this option specifies an AWS managed KMS key, and cross-account use of the encrypted value requires KMS permissions that are not appropriately controllable with an AWS managed key. Because the workloads in both accounts must retrieve and decrypt the same token, a customer managed KMS key is the correct pattern. Even aside from that, Secrets Manager is the more purpose-built service for runtime secret retrieval with lower operational overhead.

DynamoDB plus KMS can securely store encrypted data, but it is not a managed secrets solution. You would need to implement your own retrieval, caching, rotation strategy, and careful IAM scoping for DynamoDB reads and KMS decrypt. This adds operational and development overhead and increases the chance of mistakes (e.g., logging plaintext, improper key policies). It meets encryption requirements but not “least management overhead.”

S3 with SSE-KMS can encrypt objects at rest and TLS protects in transit, and bucket policies can grant cross-account access. However, S3 is not a secret store: you must manage object formats, retrieval logic, caching, and potential exposure risks (e.g., accidental broader bucket permissions). Using an AWS managed KMS key also reduces control. This is higher overhead and less aligned with best practices than Secrets Manager.

Incorrect. The AWS CLI does not authenticate with an IAM username and password. Those credentials are used for AWS Management Console sign-in (interactive web login), which the prompt explicitly says is not allowed. For API calls from the CLI, AWS requires request signing with access keys or temporary STS credentials. Even if an IAM user exists, the CLI needs access key material, not the console password.

Incorrect. SSH keys are used to authenticate to resources like EC2 instances (SSH/RDP-related workflows), some Git operations (e.g., CodeCommit via SSH), or to establish secure shell sessions. They do not provide AWS API authentication for the AWS CLI. The AWS CLI requires IAM-based credentials (access keys or STS tokens) to sign API requests, not an SSH keypair.

Incorrect. X.509 certificates are not the standard authentication mechanism for AWS CLI usage. Modern AWS API access is typically done with IAM access keys or temporary credentials from AWS STS (often via roles). While certificates appear in some legacy or specialized contexts, they are not what you configure for typical CLI-based provisioning from a laptop, and this option does not align with current best practices or common exam expectations.

Rolling deployments update instances in batches, keeping some capacity serving traffic while others are updated. This can reduce downtime, but it does not provide an exact, controlled percentage split (25%/75%) between two versions for a fixed evaluation window. During rolling, traffic goes to a mix of updated and non-updated instances based on batch progression, not a stable canary percentage.

In-place deployments update the existing instances directly (all at once or in a way that can temporarily reduce capacity). This approach can cause brief interruptions or performance degradation, especially for latency-sensitive APIs, and it does not support a controlled 25%/75% traffic split between versions. It’s generally less safe than immutable or traffic-splitting for production releases.

Immutable deployments create a new set of instances with the new version, verify health, and then switch over, which greatly reduces deployment risk and can achieve near-zero downtime. However, immutable is primarily an all-or-nothing cutover model and does not natively provide an exact 25%/75% request routing split for a timed evaluation window. That requirement maps directly to traffic-splitting.

Lambda cannot directly import Python modules from an S3 object path at runtime as part of the normal import mechanism. While S3 can store deployment artifacts, the code and dependencies must be included in the function package, a container image, or a layer. Pulling code from S3 during invocation would require custom download logic, adds latency and failure points, and is not an operationally efficient or standard pattern.

Creating a separate Lambda to perform validation/logging and invoking it synchronously turns a local library call into a network call. This increases end-to-end latency, adds per-invocation cost, introduces additional throttling and error handling concerns, and complicates tracing and retries. It also creates tight runtime coupling between functions. This is generally an anti-pattern for shared utility code that should run in-process.

Container images can include shared libraries via a base image, but migrating all functions to container packaging is more operationally heavy than needed for a 1.8-MB Python utility library. It introduces image build pipelines, ECR management, and larger deployment artifacts. While viable, it is not the MOST operationally efficient compared to Lambda layers for simple shared dependency reuse across many functions.