AWS Developer Associate (DVA-C02) Practice Exam.
Free practice test — 35 verified questions, instant feedback.

Answer: A
Conditional logging driven by an environment-variable log level lets teams get verbose debug detail in dev/test while keeping production log volume (and cost) low. Always logging full payloads (B) wastes cost and can leak sensitive data. Disabling logs (C) removes all observability, which hurts troubleshooting. Writing to /tmp (D) is ephemeral, per-container storage that isn't centralized or durable, defeating the purpose of debugging logs.

Answer: B
Lambda layers let you separate shared dependencies from function code, keeping the deployment package smaller, enabling reuse across functions, and avoiding editing large payloads inline. The console code editor (A) only supports small inline edits and can't handle large dependency trees. DynamoDB (C) is a database, not a binary/code artifact store, and loading binaries from it at runtime is impractical. Downloading dependencies at invocation time (D) adds latency and violates Lambda's stateless, fast-start execution model.

Answer: B
Provisioned capacity with auto scaling lets a table scale read/write throughput up during bursts and back down during steady periods, giving predictable baseline cost with burst tolerance. Pure on-demand (A) is simpler but can be less cost-predictable for steady, well-understood workloads. A fixed provisioned setting with no auto scaling (C) throttles during unexpected bursts. DAX (D) is a caching layer that reduces read latency and load on the table but does not itself manage or replace write/read capacity provisioning.

Answer: B
SQS standard queues provide at-least-once delivery, so occasional duplicates are expected; the correct pattern is idempotent processing (e.g., conditional writes keyed on a unique message ID) so reprocessing a duplicate is a no-op. FIFO queues (A) reduce duplicates but do not guarantee absolute zero duplicates in all failure scenarios, and switching queue types is a bigger architectural change than necessary. Setting visibility timeout to 0 (C) would make messages immediately visible to other consumers, causing more concurrent processing and more duplicates, not fewer. Ignoring the issue (D) is unsafe since duplicate writes were stated as a real problem.

Answer: A
SNS is a pub/sub service designed for fanning out one published message to many independent subscribers (SQS queues, Lambda, HTTP/S endpoints, email) simultaneously. A single SQS queue (B) delivers each message to only one consumer at a time, not to multiple independent subscribers. Step Functions (C) orchestrates sequential/parallel workflow steps rather than acting as a pub/sub fanout mechanism. Kinesis Data Streams (D) is built for ordered, replayable streaming ingestion by multiple consumer applications reading independently, but it is heavier-weight and less suited to simple fanout notification patterns than SNS.

Answer: B
API Gateway supports enabling a cache at the stage level, which stores responses for a configurable TTL and serves subsequent identical requests without invoking the backend, reducing Lambda invocations and latency. Request validation (A) checks incoming payloads against a schema before invoking the backend, it does not cache responses. Usage plans (C) control API key based throttling and quotas for API consumers, unrelated to caching. Canary deployments (D) let you shift a percentage of traffic to a new stage version for safe rollout, not for caching responses.

Answer: A
A conditional expression (ConditionExpression) on UpdateItem/PutItem enforces optimistic concurrency control: the write only succeeds if the specified condition (e.g., an attribute still matches its previously read value) holds true, otherwise it fails and the app can retry. DynamoDB Streams (B) captures a time-ordered sequence of item changes for downstream processing, it doesn't prevent conflicting writes. Increasing write capacity (C) affects throughput, not conflict detection. Local secondary indexes (D) provide alternate query patterns on sort keys, unrelated to concurrency control.

Answer: B
Code placed outside the handler, at module scope, executes once when Lambda initializes the execution environment, and persists in memory across subsequent warm invocations of that environment, allowing connection reuse. Placing it inside the handler (A) recreates the connection on every single invocation, increasing latency and potentially exhausting database connections. Invoking a separate Lambda synchronously (C) adds unnecessary latency and complexity and does not itself enable reuse. Environment variables (D) store configuration values as strings; they cannot hold a live connection object.

Answer: A
Step Functions coordinates multi-step workflows as state machines, providing built-in retry/catch error handling per state and a visual execution history for each run, which matches the described sequential order-processing needs. EventBridge alone (B) routes events between sources and targets but does not manage multi-step sequential state or retries within a single workflow. Lambda destinations (C) only route the async invocation result (success/failure) to another target, they don't orchestrate a full multi-step sequence. A single SQS queue (D) simply holds messages for one consumer and provides no native step orchestration or visual execution tracking.

Answer: A
Configuring a dead-letter queue (or the newer on-failure destination) sends the event payload to SQS or SNS after asynchronous invocation retries are exhausted, preserving failed events for later analysis. Provisioned concurrency (B) keeps execution environments warm to reduce cold starts, it has nothing to do with capturing failed events. A function URL (C) is a direct HTTPS endpoint for invoking a Lambda function, unrelated to failure handling. X-Ray tracing (D) helps trace and visualize request latency and errors across services but does not capture or store the failed event payloads for reprocessing.

Answer: B
SSE-S3 has AWS manage the encryption keys entirely, encrypting objects automatically at rest with no extra per-request key management from the developer, matching the 'least operational overhead' requirement. Client-side encryption (A) requires the application itself to manage encryption and keys, adding developer overhead. SSE-C (C) requires the caller to supply and manage the encryption key on every request, which is more operational burden, not less. Relying only on bucket policies (D) controls access but does not encrypt data at rest, and does not meet the stated encryption requirement.

Answer: B
Following least privilege, a custom IAM policy attached to the function's execution role that scopes exactly the needed S3 and DynamoDB actions/resources is the secure, correct pattern for Lambda permissions. AdministratorAccess (A) grants far more permission than needed, violating least privilege and increasing blast radius if compromised. Embedding long-term IAM user credentials in environment variables (C) is an anti-pattern; Lambda execution roles already provide temporary, automatically rotated credentials, so static keys are unnecessary and risky. Granting full access to all S3 buckets and DynamoDB tables (D) is also overly broad and violates least privilege.

Answer: A
Cognito Identity Pools are specifically designed to take identities from external providers (Google, Facebook, User Pools, etc.) and exchange them via AWS STS for temporary, scoped AWS credentials that the app can use directly against S3, DynamoDB, and other AWS services. Creating IAM users per installation (B) is unscalable, insecure (long-term credentials distributed to devices), and not the intended pattern. AWS Organizations SCPs (C) set permission guardrails across accounts, they are not an identity federation or credential-vending mechanism for end users. Cognito User Pools alone (D) handle user sign-up/sign-in and issue JWT tokens for authentication, but do not by themselves vend temporary AWS credentials — that requires pairing with an identity pool.

Answer: A
An IAM role attached via an instance profile lets the EC2 instance metadata service supply automatically rotated, temporary credentials to the application, with no long-term keys ever stored on the instance. Storing an IAM user's keys on local disk (B) directly violates the 'no long-term keys on the instance' requirement. Hard-coding keys in source (C) is a severe security anti-pattern, exposing credentials in version control and builds. Passing keys as command-line arguments (D) still requires long-term keys to exist and be handled, and exposes them in process lists and shell history.

Answer: A
Secrets Manager natively supports automatic rotation for supported database engines (like RDS) using built-in rotation Lambda templates, and secrets can be retrieved at runtime via the Secrets Manager API/SDK. Parameter Store Standard tier (B) can store secrets but does not include the same native, built-in automatic rotation workflow for database credentials without custom scripting. S3 (C) is object storage; while it can store encrypted data, it has no secret-rotation or secret-versioning feature designed for credentials. CloudHSM (D) provides dedicated hardware security modules for cryptographic key storage and operations, it is not a secrets management/rotation service for application credentials.

Answer: A
KMS customer managed keys require both the calling principal's IAM policy (the Lambda execution role must have kms:Decrypt) AND the key's own key policy to permit that principal, since KMS uses a dual-authorization model (identity-based and resource-based/key policy). Option B is false because KMS keys are never publicly decryptable by default; access is tightly scoped. Option C is incorrect because IAM identity policy grants are still required in addition to the key policy. Option D conflates a Lambda resource policy (which governs who can invoke the function) with KMS's own key policy, which governs who can use the key — these are separate mechanisms and both IAM and the key policy matter for KMS, not a Lambda resource policy.

Answer: A
IAM authorization on an API Gateway method requires callers to sign requests with SigV4 using valid IAM credentials, letting API Gateway verify the caller's identity and permissions without separate API keys. API keys with usage plans (B) are meant primarily for throttling/quota tracking of API consumers and are not tied to IAM credential based SigV4 signing. Relying only on security groups (C) does not apply to API Gateway's HTTP-level access (API Gateway does not sit behind customer-managed security groups the way EC2 does for regional REST APIs invoked over the internet), and provides no request-level identity authorization. An S3 bucket resource policy (D) governs access to S3 objects, not to API Gateway API methods.

Answer: A
CodeDeploy natively supports Lambda deployments with canary or linear traffic-shifting configurations tied to a Lambda alias, and can automatically roll back based on CloudWatch alarms if error thresholds are breached, matching every requirement in the scenario. Immediately shifting 100% of traffic with no gradual rollout or monitoring (B) is exactly the risky pattern the team wants to avoid. Creating a separate AWS account and manually redirecting DNS (C) is an unnecessarily heavyweight, manual, and error-prone approach compared to using built-in alias traffic shifting. Using Lambda versions without aliases or traffic shifting (D) provides no mechanism for gradual, percentage-based traffic shifting.

Answer: A
CloudFormation (and SAM, which compiles to CloudFormation) lets developers define infrastructure as a template and deploy/update a whole stack of related resources — Lambda, API Gateway, DynamoDB — together as one versioned, repeatable unit, satisfying the described requirement. AWS Config (B) is a service for recording and evaluating resource configuration compliance over time, not for provisioning resources. CloudWatch Synthetics canaries (C) are scripted tests that monitor endpoints and APIs, unrelated to infrastructure provisioning. Trusted Advisor (D) provides best-practice recommendations across cost, security, and performance, it does not deploy resources.

Answer: D
A CNAME/environment URL swap between a newly created 'green' environment and the existing 'blue' one lets the new environment be fully provisioned and validated before traffic is switched, with an easy rollback by swapping the CNAME back — this is the blue/green pattern, typically implemented in Beanstalk via a separate environment and swap rather than an in-place deployment policy. 'All at once' (A) replaces the application on existing instances simultaneously with no new environment and real downtime risk. 'Rolling' (B) updates batches of instances within the same environment incrementally, without provisioning a full parallel environment. 'Immutable' (C) provisions a full set of new instances within the same environment behind the scenes and shifts traffic once healthy, but does not involve two independently addressable environments with a URL swap for rollback the way blue/green does.

Answer: A
CodeBuild is a managed build service that compiles source code, runs tests, and produces deployment-ready artifacts, and it's the standard build-stage action integrated into CodePipeline. CodeCommit (B) is a managed Git source-control repository service, used for storing source code, not for building or testing it. EventBridge (C) is an event bus for routing events between AWS services and applications, not a build/test execution service. Direct Connect (D) is a dedicated network connection service between on-premises and AWS, entirely unrelated to CI/CD build processes.

Answer: A
CodePipeline natively supports a manual approval action type that pauses pipeline execution until a designated approver approves or rejects it in the console or via API/SNS notification, which is exactly the gate described. Setting a stage timeout to zero (B) would simply fail the stage rather than create an approval gate. Removing the stage and deploying manually (C) abandons the automated pipeline entirely, losing consistency and auditability. An IAM deny policy on the service role (D) would block the pipeline from ever executing that stage, it does not create a resumable manual-approval gate.

Answer: A
X-Ray traces requests end-to-end and, with the SDK instrumenting the outbound call as a subsegment, breaks down exactly how much time is spent in Lambda's own code versus waiting on the downstream call, across a service map and trace timeline. CloudWatch Alarms alone (B) can trigger on metrics like duration or error count crossing a threshold but provide no per-call breakdown of where time was spent within an invocation. AWS Config aggregators (C) consolidate resource configuration compliance data across accounts/regions, unrelated to latency tracing. Amazon Inspector network reachability rules (D) assess network configuration and vulnerability exposure, not runtime call latency breakdown.

Answer: A
IteratorAge measures the age of the last record in a batch relative to when it was written to the stream, and a steadily increasing value means the consumer is falling behind the incoming stream rate, so increasing Lambda concurrency/parallelization or optimizing per-record processing time are reasonable remediations. DynamoDB tables are not backed by attachable EBS volumes and don't 'run out of storage' in the way EC2 instances do (B), making that option nonsensical. IteratorAge is a stream-processing lag metric, not an authorization/permission error signal, so KMS permissions (C) are unrelated. Lowering read capacity (D) would not address a consumer falling behind and could make matters worse by throttling reads needed to catch up.

Answer: A
Exponential backoff with jitter progressively increases the wait time between retries and randomizes it slightly, reducing the chance of synchronized retry storms and giving the throttled service time to recover; most AWS SDKs have this built in and configurable. A tight retry loop with no delay (B) would likely worsen throttling by hammering the API even harder. Silently discarding failed requests (C) violates the requirement to handle errors comprehensively and loses data or work. Increasing Lambda memory (D) affects the function's own CPU/memory allocation, it has no effect on a downstream service's independent throttling limits.

Answer: A
Because Lambda can scale out to many concurrent execution environments, each potentially opening its own DB connection, a burst of concurrency can exceed the database's max connections; introducing RDS Proxy (or another pooling layer) multiplexes connections and mitigates this. A missing rds:Connect IAM permission (B) typically produces an authorization/access-denied error, not specifically a 'too many connections' error. CloudWatch Logs rate limiting (C) affects log delivery, not database connection establishment, and is not a known cause of DB connection errors. This scenario is about RDS, not DynamoDB, so DynamoDB read capacity (D) is irrelevant to the described symptom.

Answer: A
A 'cold start' occurs when Lambda must initialize a new execution environment (downloading code, starting the runtime, running init code) before handling the first invocation, causing extra latency; provisioned concurrency pre-initializes a set number of environments to eliminate this for latency-sensitive workloads. DAX (B) is attached to DynamoDB access patterns, not to Lambda's own execution environment lifecycle, and doesn't address Lambda cold starts. API Gateway stage caching (C) affects whether a request reaches the backend at all, it is unrelated to Lambda's internal environment initialization latency. IAM policy evaluation (D) happens quickly at request-authorization time and is not the documented cause of the 'first invocation after inactivity is slow' pattern.

Answer: A
X-Ray active tracing across API Gateway, Lambda, and instrumented downstream SDK calls (including DynamoDB) stitches together a single end-to-end trace with per-segment/subsegment latency, which is exactly the multi-hop bottleneck analysis described. Default Lambda CloudWatch duration metrics (B) show only the Lambda function's own execution duration, not a stitched cross-service view including API Gateway and DynamoDB. VPC Flow Logs (C) capture IP traffic metadata (source/destination, ports, bytes) for network-level analysis, not application-level per-hop request latency. AWS Config (D) tracks resource configuration changes over time for compliance and auditing, not runtime request latency.

Answer: A
AWS states that of the 65 total questions, 50 are scored and count toward the final result, while 15 are unscored pretest items AWS uses to gather performance data for future exam versions, indistinguishable to the candidate from scored questions. Option B is incorrect because AWS explicitly includes unscored items in this exam. Option C misstates both counts. Option D invents a time-based scoring rule that does not reflect how the unscored/scored item split actually works — the split is per-item by design, not based on when in the exam a question is answered.

Answer: A
AWS reports scores on a scaled range of 100 to 1,000, and the minimum passing score for this exam is 720; the scaling accounts for minor difficulty differences across exam forms, so it is not simply a raw percentage. Option B incorrectly describes the scale as a raw percentage rather than the official 100-1,000 scaled score. Option C uses the wrong scale entirely (0-100). Option D uses the correct scale but the wrong passing threshold — 500, not 720, which would misinform a candidate about how many correct answers are actually needed to pass.

Answer: A
API Gateway request validation lets you attach a JSON Schema model to a method, rejecting malformed or incomplete request bodies (and missing required parameters) with a 400 error before the request ever reaches the Lambda integration, exactly matching the described goal. Usage plans (B) throttle and meter API key usage, they don't validate payload structure. A Lambda authorizer focused on the Authorization header (C) handles authentication/authorization decisions, not payload schema validation. X-Ray tracing (D) provides observability into request flow and latency, it does not block or validate malformed requests.

Answer: A
ECS's CodeDeploy blue/green deployment integration provisions a new (green) task set alongside the running (blue) one, uses ALB target group health checks to validate the new set, shifts traffic over, and can automatically roll back if health checks or CloudWatch alarms fail — matching every requirement described. Manually stopping and starting all tasks at once (B) causes downtime and provides no automated health-check gating or rollback. S3 static website hosting (C) serves static files and is unrelated to container orchestration or ECS deployments. Direct Connect (D) is a dedicated network link between on-premises infrastructure and AWS, entirely unrelated to application deployment strategy.

Answer: A
By default, if a CloudFormation stack update fails, CloudFormation automatically rolls back the changes to restore the stack to its last successful state, requiring no manual intervention. Stack termination protection (B) simply prevents a stack from being accidentally deleted, it has nothing to do with handling failed updates. Drift detection (C) identifies when actual resource configuration has diverged from the stack's template, it does not perform any rollback action. Explicitly setting DisableRollback=true (D) would do the opposite of what's needed — it prevents automatic rollback, leaving the stack in a partially updated/failed state for manual troubleshooting.

Answer: A
VPC peering establishes a private, direct network connection between two VPCs (even across accounts, within a supported region configuration), and with the right route table entries traffic flows privately without traversing the public internet, a NAT gateway, or a VPN — matching the requirement exactly. Making RDS publicly accessible (B) explicitly routes traffic over the public internet, which the requirement rules out, and is also a security risk. Direct Connect (C) establishes a dedicated network link between on-premises infrastructure and AWS, it is not used to connect two VPCs within AWS to each other. CloudFront (D) is a content delivery network for caching and distributing content (typically HTTP/S), not a mechanism for private database connectivity between VPCs.

Answer: A
When a Lambda function is attached to a VPC to reach private resources like RDS, it loses default internet/public-AWS-service access from that private subnet unless outbound connectivity is provided by a NAT gateway (for internet-routed calls) or, more efficiently, VPC endpoints for services like DynamoDB and S3, combined with a security group permitting the necessary traffic. Option B is incorrect because VPC-attached functions do not automatically retain access to public AWS endpoints without additional NAT or VPC endpoint configuration. Option C is incorrect because Lambda must be attached to the VPC (with appropriate subnet/security group config) to reach resources like a private RDS instance with no public endpoint. Option D is incorrect because security groups are still required to control network access to Lambda's elastic network interfaces, and public subnets with only an internet gateway don't address reaching resources in a private subnet.