AWS Certified Developer - Associate (DVA-C02)

Changing from Regional to Edge-Optimized affects how clients reach API Gateway (CloudFront distribution in front) and can improve latency for global users, but it does not change the required Lambda proxy response format. Endpoint type mismatches or CloudFront issues typically show different symptoms (DNS/403/5xx at edge), not a consistent 502 caused by a malformed integration response after Lambda succeeds.

For a GET /shipments/{trackingId}, there is typically no request body. The request clearly reached API Gateway and invoked the Lambda function (as evidenced by Lambda logs). A malformed client payload would more likely cause a 400 (bad request) or mapping/template errors before invocation, not a 502 after Lambda returns. The core issue is the response format, not the request.

Authorization issues (missing/invalid credentials) are handled by API Gateway before invoking Lambda and typically result in 401 Unauthorized or 403 Forbidden, not a 502. The evidence shows Lambda was invoked and completed successfully, so the request was authorized to reach the integration. The problem occurs when API Gateway tries to interpret the Lambda output, not when authenticating the caller.

Incorrect. SQS plus a custom consumer can detect >2000 ms values, but it introduces operational overhead: you must build, deploy, scale, and monitor the consumer, handle failures, retries, and poison messages. This is not the least-ops solution when CloudWatch alarms can natively evaluate thresholds and trigger SNS notifications.

Incorrect. An alarm on the average over 1 minute can miss single slow authorizations because the average may remain below 2000 ms even if one request exceeds 2 seconds. It also uses SES, which is not the standard service for CloudWatch alarm notifications (SNS is). This fails the “any single authorization” requirement.

Incorrect. Kinesis is unnecessary and adds operational complexity and cost for this use case. Also, CloudWatch alarms do not evaluate “any stream value” inside Kinesis records directly; you would still need a consumer (Lambda/KCL) to extract values and publish a metric. That defeats the least operational overhead requirement compared to direct CloudWatch custom metrics.

Incorrect. AWS Lambda does not support mounting arbitrary “snapshots” of dependencies as a filesystem in the way EC2 can use EBS snapshots. Lambda provides /tmp ephemeral storage and optional EFS mounting, but not snapshot mounting. This option describes a non-existent Lambda feature and would not be a valid deployment approach for oversized dependencies.

Incorrect. Although arm64 can sometimes provide better price/performance and may change dependency footprint, the question explicitly states the function uses x86_64 and that it must remain unchanged. Therefore, switching architectures violates a hard requirement. Additionally, changing architecture can introduce compatibility issues for native libraries like OpenCV/SciPy.

Incorrect. Lambda cannot attach an Amazon EBS volume. EBS is an EC2 block storage service and requires an EC2 instance to attach. For Lambda, the supported network filesystem option is Amazon EFS (and only within a VPC), but even EFS is not the best fit here compared to container images for packaging large dependencies.

Incorrect. AWS CodeDeploy is designed for deploying applications to EC2, Lambda, or ECS and coordinating deployment hooks, not for CI unit testing and rich test report visualization. Publishing results as CloudWatch metrics does not create a navigable JUnit-style report for auditors, and it would require additional tooling/dashboards to interpret detailed per-test-case results. It also couples unit testing to deployments, which is not a best practice for fast feedback CI.

Incorrect. Amazon CodeWhisperer is an AI coding assistant, not a CI system. It does not orchestrate builds on commits, run unit tests at scale, or provide standardized test report visualization. Storing raw outputs in S3 alone does not meet the requirement for a navigable JUnit-style report without building a UI; you would still need a viewer or reporting layer to interpret and browse results.

Incorrect. Lambda is not appropriate for compiling/building typical microservices and running full unit test suites due to execution time limits, dependency/tooling complexity, and ephemeral storage constraints. Storing results in a Lambda layer is not a durable, queryable, auditor-friendly retention mechanism and does not provide a navigable JUnit report UI. This approach would effectively require building and maintaining custom CI/reporting plumbing.

RDS + ElastiCache for Redis with lazy loading can achieve low latency, but lazy loading inherently risks stale reads (cache is refreshed on demand or via TTL). Meeting “never see stale data” requires explicit write-through updates or invalidation on every write/delete, plus careful handling of race conditions. Operational overhead is higher (cache-aside logic, invalidation, potential thundering herd) than using DAX with DynamoDB.

An in-process memory cache with lazy loading is operationally risky for a global, scaled service. Each application instance has its own cache, so updates/deletes won’t propagate instantly across the fleet, causing stale data. Achieving coherency would require a distributed invalidation mechanism (pub/sub, messaging) and careful coordination, increasing complexity and still not guaranteeing microsecond p95 across all instances.

DAX only works with DynamoDB; it cannot accelerate Amazon RDS. Also, “configure a TTL on the DAX cluster” is not how DAX consistency is achieved—TTL-based expiration would still allow stale reads until expiry and does not satisfy immediate update/delete requirements. This option is architecturally invalid and mixes incompatible services.

Migrating to DynamoDB violates key constraints: the team cannot change the database engine and cannot modify the database structure. Moving a 5-year relational analytics dataset with complex SQL views to DynamoDB would require significant re-modeling, query rewrites, and likely pre-aggregation. It also increases project risk and time-to-value compared to caching, and it is not “minimal management overhead” for this scenario.

Memcached on EC2 can cache responses, but it is self-managed: you must handle instance sizing, scaling policies, patching, failures, and cache warm-up behavior. This conflicts with the requirement to minimize management overhead. Additionally, ElastiCache provides a managed caching layer with better operational simplicity and built-in features (monitoring, maintenance) compared to running Memcached yourself on EC2.

DynamoDB Accelerator (DAX) only works in front of Amazon DynamoDB tables to accelerate DynamoDB reads. It cannot be placed in front of Amazon RDS for PostgreSQL and does not accelerate SQL queries or views. This option is a common exam trap: DAX is not a generic database cache and is not compatible with RDS engines.

Incorrect. AWS X-Ray focuses on distributed tracing (latency breakdowns, service maps, traces/segments) and can provide insights into request paths and downstream calls. It does not collect OS-level metrics like memory utilization, swap usage, filesystem utilization, or disk I/O at 1-minute granularity. X-Ray also is not the standard mechanism for ingesting arbitrary custom metrics such as cacheHitRate and queueDepth into CloudWatch.

Incorrect. Modifying the application to publish metrics via the AWS SDK could work for custom application metrics, but it requires code changes and does not inherently provide OS-level metrics like memory, swap, and filesystem utilization. You would still need an agent or additional host instrumentation to gather those OS metrics. This approach increases development effort and risk compared to using the CloudWatch agent’s built-in capabilities.

Incorrect. AWS CloudTrail records AWS API calls for governance, compliance, and auditing (who did what, when, from where). It does not capture per-instance OS performance metrics or custom application metrics. CloudTrail logs are useful for security investigations and change tracking, not for right-sizing based on CPU/memory/disk utilization or for monitoring application-level KPIs like cacheHitRate and queueDepth.

Creating a new Lambda alias does not update the function’s code package. Aliases are pointers to published versions and are used for traffic shifting, stable ARNs, and deployment strategies (e.g., blue/green with CodeDeploy). If the underlying function code is not updated (or a new version is not published), a new alias won’t cause CloudFormation to pull a new ZIP from S3.

Uploading to a different bucket is unnecessary and does not inherently solve the problem unless the template is also updated to reference that new bucket/key/version. The core issue is CloudFormation not seeing a change in the Lambda Code definition. Changing buckets adds operational complexity and is not the recommended mechanism for deterministic deployments.

A code-signing configuration enforces that Lambda only deploys code signed by trusted publishers, improving supply-chain security. It does not force CloudFormation to redeploy code when the S3 key remains the same. Even with code signing, CloudFormation still requires a change in S3Key or S3ObjectVersion (or equivalent) to trigger an update.

Amazon SQS is a message queue optimized for decoupling producers and consumers with at-least-once delivery, but it uses a competing-consumer model: once a message is consumed and deleted, other consumers cannot read it. You could duplicate messages to multiple queues or use SNS-to-SQS fanout, but that explicitly duplicates the pipeline per consumer and complicates replay/checkpointing semantics compared to a true stream.

Amazon Kinesis Data Firehose is a fully managed delivery service that buffers and delivers streaming data to destinations like S3, Redshift, and OpenSearch. It is not designed for multiple EC2-based applications to concurrently consume the same stream with sub-second latency and independent checkpoint/replay. Firehose focuses on delivery with buffering (seconds to minutes) and transformation, not multi-consumer real-time processing.

Amazon EventBridge is an event bus for routing events to targets with filtering and SaaS integration. While it supports multiple targets, it is not a streaming service with shard-based throughput, ordered records, and consumer-controlled checkpoints. EventBridge also does not provide the same stream replay model (per-consumer resume from sequence checkpoints) required for crash recovery and near-real-time stream processing at scale.

Incorrect. The CloudWatch agent is used for publishing OS/application metrics and logs to Amazon CloudWatch. CodeDeploy does not require the CloudWatch agent to perform deployments or evaluate deployment success. While CloudWatch can help with troubleshooting (e.g., viewing logs/metrics during a rollout), its absence would not directly cause CodeDeploy to fail with HEALTH_CONSTRAINTS.

Incorrect. If the developer’s IAM user lacked codedeploy:CreateDeployment, the deployment would fail to start and would be denied immediately by IAM. The scenario describes a rollout that began and then aborted at 6 minutes due to health constraints, which indicates instance-level deployment execution/health issues rather than a caller authorization problem.

Incorrect. There is no universal requirement to enable a special “CodeDeploy health checks” feature for every deployment group. CodeDeploy health behavior is driven by deployment configurations (minimum healthy hosts, batch size) and optional integrations like load balancers and alarms. HEALTH_CONSTRAINTS is typically caused by real instance failures or insufficient healthy capacity, not by a missing mandatory feature toggle.

Incorrect. It only filters on action="normalize" and does not restrict service="rates-pipeline", so it could include normalize events from other services. It also aggregates by bin(1s) (1-second intervals) rather than the required 1-minute intervals, producing far more granular and noisy results than requested. Even though the stats functions are correct, the filter and bin size do not meet the question requirements.

Incorrect. While it correctly filters on service and action and uses bin(1m), it swaps the meanings of fastest and slowest by labeling max(latency_ms) as fastest_ms and min(latency_ms) as slowest_ms. In latency measurements, the fastest request corresponds to the minimum latency, and the slowest corresponds to the maximum latency. This is a common exam trick focused on careful interpretation of min/max.

Incorrect in context. It uses parse @message "normalize completed in * ms" to extract latency_ms, which is only necessary if the logs are unstructured text. The question states each JSON log event already includes an integer field latency_ms, so parsing is unnecessary and may fail if the message format differs. It also does not filter on service and action, so it could include unrelated events that match the parsed pattern.

Systems Manager Parameter Store SecureString can store sensitive values and can be shared across accounts in some scenarios by using resource policies on advanced parameters. However, this option specifies an AWS managed KMS key, and cross-account use of the encrypted value requires KMS permissions that are not appropriately controllable with an AWS managed key. Because the workloads in both accounts must retrieve and decrypt the same token, a customer managed KMS key is the correct pattern. Even aside from that, Secrets Manager is the more purpose-built service for runtime secret retrieval with lower operational overhead.

DynamoDB plus KMS can securely store encrypted data, but it is not a managed secrets solution. You would need to implement your own retrieval, caching, rotation strategy, and careful IAM scoping for DynamoDB reads and KMS decrypt. This adds operational and development overhead and increases the chance of mistakes (e.g., logging plaintext, improper key policies). It meets encryption requirements but not “least management overhead.”

S3 with SSE-KMS can encrypt objects at rest and TLS protects in transit, and bucket policies can grant cross-account access. However, S3 is not a secret store: you must manage object formats, retrieval logic, caching, and potential exposure risks (e.g., accidental broader bucket permissions). Using an AWS managed KMS key also reduces control. This is higher overhead and less aligned with best practices than Secrets Manager.

Incorrect. The AWS CLI does not authenticate with an IAM username and password. Those credentials are used for AWS Management Console sign-in (interactive web login), which the prompt explicitly says is not allowed. For API calls from the CLI, AWS requires request signing with access keys or temporary STS credentials. Even if an IAM user exists, the CLI needs access key material, not the console password.

Incorrect. SSH keys are used to authenticate to resources like EC2 instances (SSH/RDP-related workflows), some Git operations (e.g., CodeCommit via SSH), or to establish secure shell sessions. They do not provide AWS API authentication for the AWS CLI. The AWS CLI requires IAM-based credentials (access keys or STS tokens) to sign API requests, not an SSH keypair.

Incorrect. X.509 certificates are not the standard authentication mechanism for AWS CLI usage. Modern AWS API access is typically done with IAM access keys or temporary credentials from AWS STS (often via roles). While certificates appear in some legacy or specialized contexts, they are not what you configure for typical CLI-based provisioning from a laptop, and this option does not align with current best practices or common exam expectations.

Rolling deployments update instances in batches, keeping some capacity serving traffic while others are updated. This can reduce downtime, but it does not provide an exact, controlled percentage split (25%/75%) between two versions for a fixed evaluation window. During rolling, traffic goes to a mix of updated and non-updated instances based on batch progression, not a stable canary percentage.

In-place deployments update the existing instances directly (all at once or in a way that can temporarily reduce capacity). This approach can cause brief interruptions or performance degradation, especially for latency-sensitive APIs, and it does not support a controlled 25%/75% traffic split between versions. It’s generally less safe than immutable or traffic-splitting for production releases.

Immutable deployments create a new set of instances with the new version, verify health, and then switch over, which greatly reduces deployment risk and can achieve near-zero downtime. However, immutable is primarily an all-or-nothing cutover model and does not natively provide an exact 25%/75% request routing split for a timed evaluation window. That requirement maps directly to traffic-splitting.

Lambda cannot directly import Python modules from an S3 object path at runtime as part of the normal import mechanism. While S3 can store deployment artifacts, the code and dependencies must be included in the function package, a container image, or a layer. Pulling code from S3 during invocation would require custom download logic, adds latency and failure points, and is not an operationally efficient or standard pattern.

Creating a separate Lambda to perform validation/logging and invoking it synchronously turns a local library call into a network call. This increases end-to-end latency, adds per-invocation cost, introduces additional throttling and error handling concerns, and complicates tracing and retries. It also creates tight runtime coupling between functions. This is generally an anti-pattern for shared utility code that should run in-process.

Container images can include shared libraries via a base image, but migrating all functions to container packaging is more operationally heavy than needed for a 1.8-MB Python utility library. It introduces image build pipelines, ECR management, and larger deployment artifacts. While viable, it is not the MOST operationally efficient compared to Lambda layers for simple shared dependency reuse across many functions.