Amazon DVA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
Question #91
A team of developed is using an AWS CodePipeline pipeline as a continuous integration and continuous delivery (CI/CD) mechanism for a web application. A developer has written unit tests to programmatically test the functionality of the application code. The unit tests produce a test report that shows the results of each individual check. The developer now wants to run these tests automatically during the CI/CD process.
- A . Write a Git pre-commit hook that runs the test before every commit. Ensure that each developer who is working on the project has the pre-commit hook instated locally. Review the test report and resolve any issues before pushing changes to AWS CodeCommit.
- B . Add a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage after the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test does not pass. Use the test reports feature of Codebuild to integrate the report with the CodoBuild console. View the test results in CodeBuild Resolve any issues.
- C . Add a new stage to the pipeline. Use AWS CodeBuild at the provider. Add the new stage before the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage it any test does not pass. Use the test reports feature of CodeBuild to integrate the report with the CodeBuild console. View the test results in codeBuild Resolve any issues.
- D . Add a new stage to the pipeline. Use Jenkins as the provider. Configure CodePipeline to use Jenkins to run the unit tests. Write a Jenkinsfile that fails the stage if any test does not pass. Use the test report plugin for Jenkins to integrate the repot with the Jenkins dashboard. View the test results in Jenkins. Resolve any issues.
Correct Answer: C
C
Explanation:
The solution that will meet the requirements is to add a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage before the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test does not pass. Use the test reports feature of CodeBuild to integrate the report with the CodeBuild console. View the test results in CodeBuild. Resolve any issues. This way, the developer can run the unit tests automatically during the CI/CD process and catch any bugs before deploying to the test environment. The developer can also use the test reports feature of CodeBuild to view and analyze the test results in a graphical interface. The other options either involve running the tests manually, running them after deployment, or using a different provider that requires additional configuration and integration.
Reference: Test reports for CodeBuild
C
Explanation:
The solution that will meet the requirements is to add a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage before the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test does not pass. Use the test reports feature of CodeBuild to integrate the report with the CodeBuild console. View the test results in CodeBuild. Resolve any issues. This way, the developer can run the unit tests automatically during the CI/CD process and catch any bugs before deploying to the test environment. The developer can also use the test reports feature of CodeBuild to view and analyze the test results in a graphical interface. The other options either involve running the tests manually, running them after deployment, or using a different provider that requires additional configuration and integration.
Reference: Test reports for CodeBuild
Question #92
A developer is creating an AWS Lambda function that needs credentials to connect to an Amazon RDS for MySQL database. An Amazon S3 bucket currently stores the credentials. The developer needs to improve the existing solution by implementing credential rotation and secure storage. The developer also needs to provide integration with the Lambda function.
Which solution should the developer use to store and retrieve the credentials with the LEAST management overhead?
- A . Store the credentials in AWS Systems Manager Parameter Store. Select the database that the parameter will access. Use the default AWS Key Management Service (AWS KMS) key to encrypt the parameter. Enable automatic rotation for the parameter. Use the parameter from Parameter Store on the Lambda function to connect to the database.
- B . Encrypt the credentials with the default AWS Key Management Service (AWS KMS) key. Store the credentials as environment variables for the Lambda function. Create a second Lambda function to generate new credentials and to rotate the credentials by updating the environment variables of the first Lambda function. Invoke the second Lambda function by using an Amazon EventBridge rule that runs on a schedule. Update the database to use the new credentials. On the first Lambda function, retrieve the credentials from the environment variables. Decrypt the credentials by using AWS KMS, Connect to the database.
- C . Store the credentials in AWS Secrets Manager. Set the secret type to Credentials for Amazon RDS database. Select the database that the secret will access. Use the default AWS Key Management Service (AWS KMS) key to encrypt the secret. Enable automatic rotation for the secret. Use the secret from Secrets Manager on the Lambda function to connect to the database.
- D . Encrypt the credentials by using AWS Key Management Service (AWS KMS). Store the credentials in an Amazon DynamoDB table. Create a second Lambda function to rotate the credentials. Invoke the second Lambda function by using an Amazon EventBridge rule that runs on a schedule. Update the DynamoDB table. Update the database to use the generated credentials. Retrieve the credentials from DynamoDB with the first Lambda function. Connect to the database.
Correct Answer: C
C
Explanation:
AWS Secrets Manager is a service that helps you protect secrets needed to access your applications, services, and IT resources. Secrets Manager enables you to store, retrieve, and rotate secrets such as database credentials, API keys, and passwords. Secrets Manager supports a secret type for RDS databases, which allows you to select an existing RDS database instance and generate credentials for it. Secrets Manager encrypts the secret using AWS Key Management Service (AWS KMS) keys and enables automatic rotation of the secret at a specified interval. A Lambda function can use the AWS SDK or CLI to retrieve the secret from Secrets Manager and use it to connect to the database.
Reference: Rotating your AWS Secrets Manager secrets
C
Explanation:
AWS Secrets Manager is a service that helps you protect secrets needed to access your applications, services, and IT resources. Secrets Manager enables you to store, retrieve, and rotate secrets such as database credentials, API keys, and passwords. Secrets Manager supports a secret type for RDS databases, which allows you to select an existing RDS database instance and generate credentials for it. Secrets Manager encrypts the secret using AWS Key Management Service (AWS KMS) keys and enables automatic rotation of the secret at a specified interval. A Lambda function can use the AWS SDK or CLI to retrieve the secret from Secrets Manager and use it to connect to the database.
Reference: Rotating your AWS Secrets Manager secrets
Question #93
A company has multiple Amazon VPC endpoints in the same VPC. A developer needs configure an Amazon S3 bucket policy so users can access an S3 bucket only by using these VPC endpoints.
Which solution will meet these requirements?
- A . Create multiple S3 bucket polices by using each VPC endpoint ID that have the aws SourceVpce value in the StringNotEquals condition.
- B . Create a single S3 bucket policy that has the aws SourceVpc value and in the StingNotEquals condition to use VPC ID.
- C . Create a single S3 bucket policy that the multiple aws SourceVpce value and in the SringNotEquals condton to use vpce.
- D . Create a single S3 bucket policy that has multiple aws sourceVpce value in the StingNotEquale condition. Repeat for all the VPC endpoint IDs.
Correct Answer: D
D
Explanation:
This solution will meet the requirements by creating a single S3 bucket policy that denies access to the S3 bucket unless the request comes from one of the specified VPC endpoints. The aws: SourceVpce condition key is used to match the ID of the VPC endpoint that is used to access the S3 bucket. The StringNotEquals condition operator is used to negate the condition, so that only requests from the listed VPC endpoints are allowed.
Option A is not optimal because it will create multiple S3 bucket policies, which is not possible as only one bucket policy can be attached to an S3 bucket.
Option B is not optimal because it will use the aws:SourceVpc condition key, which matches the ID of the VPC that is used to access the S3 bucket, not the VPC endpoint.
Option C is not optimal because it will use the StringNotEquals condition operator with a single value, which will deny access to the S3 bucket from all VPC endpoints except one.
Reference: Using Amazon S3 Bucket Policies and User Policies, AWS Global Condition Context Keys
D
Explanation:
This solution will meet the requirements by creating a single S3 bucket policy that denies access to the S3 bucket unless the request comes from one of the specified VPC endpoints. The aws: SourceVpce condition key is used to match the ID of the VPC endpoint that is used to access the S3 bucket. The StringNotEquals condition operator is used to negate the condition, so that only requests from the listed VPC endpoints are allowed.
Option A is not optimal because it will create multiple S3 bucket policies, which is not possible as only one bucket policy can be attached to an S3 bucket.
Option B is not optimal because it will use the aws:SourceVpc condition key, which matches the ID of the VPC that is used to access the S3 bucket, not the VPC endpoint.
Option C is not optimal because it will use the StringNotEquals condition operator with a single value, which will deny access to the S3 bucket from all VPC endpoints except one.
Reference: Using Amazon S3 Bucket Policies and User Policies, AWS Global Condition Context Keys
Question #94
When using Amazon DynamoDB, what feature automatically adjusts throughput capacity in response to dynamically changing workloads?
- A . DynamoDB Accelerator (DAX)
- B . Auto Scaling
- C . Global Tables
- D . On-Demand Capacity
Correct Answer: B
Question #95
A developer has built an application that inserts data into an Amazon DynamoDB table. The table is configured to use provisioned capacity. The application is deployed on a burstable nano Amazon EC2 instance. The application logs show that the application has been failing because of a ProvisionedThroughputExceededException error.
Which actions should the developer take to resolve this issue? (Select TWO.)
- A . Move the application to a larger EC2 instance.
- B . Increase the number of read capacity units (RCUs) that are provisioned for the DynamoDB table.
- C . Reduce the frequency of requests to DynamoDB by implementing exponential backoff.
- D . Increase the frequency of requests to DynamoDB by decreasing the retry delay.
- E . Change the capacity mode of the DynamoDB table from provisioned to on-demand.
Correct Answer: BC
BC
Explanation:
Requirement Summary:
DynamoDB Provisioned Mode
ProvisionedThroughputExceededException error occurring
App hosted on a small burstable EC2 instance
Option A: Move to a larger EC2 instance
❌ May improve local performance, but does not solve DynamoDB provisioned throughput limits.
Option B: Increase DynamoDB RCUs
✅ Valid: This directly increases the read throughput capacity of the table. Helps handle more traffic and reduce throughput exceptions.
Option C: Reduce frequency via exponential backoff
✅ Best practice: Using exponential backoff and jitter reduces request pressure and spreads retries out to avoid spiking.
Option D: Increase frequency of retries by reducing delay
❌ Opposite of best practice. Increases load, worsening the issue.
Option E: Change to on-demand mode
✅ Also valid in general, but question is scoped around provisioned capacity.
Since minimizing cost or workload type isn’t mentioned, and scaling the existing model is the focus, prefer B and C.
ProvisionedThroughputExceededException:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HandlingErrors.html
Exponential backoff:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Programming.Errors.html
Capacity modes:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadWriteCa
pacityMode.html
BC
Explanation:
Requirement Summary:
DynamoDB Provisioned Mode
ProvisionedThroughputExceededException error occurring
App hosted on a small burstable EC2 instance
Option A: Move to a larger EC2 instance
❌ May improve local performance, but does not solve DynamoDB provisioned throughput limits.
Option B: Increase DynamoDB RCUs
✅ Valid: This directly increases the read throughput capacity of the table. Helps handle more traffic and reduce throughput exceptions.
Option C: Reduce frequency via exponential backoff
✅ Best practice: Using exponential backoff and jitter reduces request pressure and spreads retries out to avoid spiking.
Option D: Increase frequency of retries by reducing delay
❌ Opposite of best practice. Increases load, worsening the issue.
Option E: Change to on-demand mode
✅ Also valid in general, but question is scoped around provisioned capacity.
Since minimizing cost or workload type isn’t mentioned, and scaling the existing model is the focus, prefer B and C.
ProvisionedThroughputExceededException:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HandlingErrors.html
Exponential backoff:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Programming.Errors.html
Capacity modes:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadWriteCa
pacityMode.html
Question #96
A company has a serverless application that uses an Amazon API Gateway API to invoke an AWS Lambda function. A developer creates a fix for a defect in the Lambda function code. The developer wants to deploy this fix to the production environment. To test the changes, the developer needs to send 10% of the live production traffic to the updated Lambda function version. Options:
- A . Publish a new version of the Lambda function that contains the updated code.
- B . Set up a new stage in API Gateway with a new Lambda function version. Enable weighted routing in API Gateway stages.
- C . Create an alias for the Lambda function. Configure weighted routing on the alias. Specify a 10% weight for the new Lambda function version.
- D . Set up a routing policy on a Network Load Balancer. Configure 10% of the traffic to go to the new Lambda function version.
- E . Set up a weighted routing policy by using Amazon Route 53. Configure 10% of the traffic to go to the new Lambda function version.
Correct Answer: A, C
A, C
Explanation:
Step 1: Understanding the Requirements
Gradual Traffic Shift: Test the new version by routing only 10% of production traffic to it.
Lambda Deployment: Use versioning and aliases to manage Lambda function updates.
Step 2: Solution Analysis
Option A:
Publishing a new version creates an immutable version of the Lambda function with the updated code.
This is a prerequisite for deploying changes using weighted aliases.
Correct option.
Option B:
API Gateway stages are not used for weighted routing; they represent environments like "dev" or "prod."
Weighted routing is implemented using Lambda aliases, not API Gateway stages.
Not suitable.
Option C:
Lambda aliases allow traffic to be split between versions using weighted routing.
Assign a 90% weight to the old version and 10% to the new version to implement the gradual rollout.
Correct option.
Option D:
Network Load Balancers are not suitable for managing Lambda function traffic directly.
Not applicable.
Option E:
Route 53 routing policies apply at the DNS level and are not designed for Lambda version
management.
Not suitable.
Step 3: Implementation Steps
Publish a New Version:
Publish the updated Lambda function code as a new version.
Create an Alias and Configure Weighted Routing:
Create an alias (e.g., prod) and associate it with both the old and new versions.
Set weights for traffic distribution:
aws lambda update-alias –function-name my-function
–name prod –routing-config ‘{"AdditionalVersionWeights": {"2": 0.1}}’
AWS Developer
Reference: Lambda Function Aliases
Weighted Traffic Routing with Lambda
A, C
Explanation:
Step 1: Understanding the Requirements
Gradual Traffic Shift: Test the new version by routing only 10% of production traffic to it.
Lambda Deployment: Use versioning and aliases to manage Lambda function updates.
Step 2: Solution Analysis
Option A:
Publishing a new version creates an immutable version of the Lambda function with the updated code.
This is a prerequisite for deploying changes using weighted aliases.
Correct option.
Option B:
API Gateway stages are not used for weighted routing; they represent environments like "dev" or "prod."
Weighted routing is implemented using Lambda aliases, not API Gateway stages.
Not suitable.
Option C:
Lambda aliases allow traffic to be split between versions using weighted routing.
Assign a 90% weight to the old version and 10% to the new version to implement the gradual rollout.
Correct option.
Option D:
Network Load Balancers are not suitable for managing Lambda function traffic directly.
Not applicable.
Option E:
Route 53 routing policies apply at the DNS level and are not designed for Lambda version
management.
Not suitable.
Step 3: Implementation Steps
Publish a New Version:
Publish the updated Lambda function code as a new version.
Create an Alias and Configure Weighted Routing:
Create an alias (e.g., prod) and associate it with both the old and new versions.
Set weights for traffic distribution:
aws lambda update-alias –function-name my-function
–name prod –routing-config ‘{"AdditionalVersionWeights": {"2": 0.1}}’
AWS Developer
Reference: Lambda Function Aliases
Weighted Traffic Routing with Lambda
Question #97
A developer is building a serverless application that is based on AWS Lambda. The developer initializes the AWS software development kit (SDK) outside of the Lambda handcar function.
What is the PRIMARY benefit of this action?
- A . Improves legibility and systolic convention
- B . Takes advantage of runtime environment reuse
- C . Provides better error handling
- D . Creates a new SDK instance for each invocation
Correct Answer: B
B
Explanation:
This benefit occurs when initializing the AWS SDK outside of the Lambda handler function because it allows the SDK instance to be reused across multiple invocations of the same function. This can improve performance and reduce latency by avoiding unnecessary initialization overhead. If the SDK is initialized inside the handler function, it will create a new SDK instance for each invocation, which can increase memory usage and execution time.
Reference: [AWS Lambda execution environment], [Best Practices for Working with AWS Lambda Functions]
B
Explanation:
This benefit occurs when initializing the AWS SDK outside of the Lambda handler function because it allows the SDK instance to be reused across multiple invocations of the same function. This can improve performance and reduce latency by avoiding unnecessary initialization overhead. If the SDK is initialized inside the handler function, it will create a new SDK instance for each invocation, which can increase memory usage and execution time.
Reference: [AWS Lambda execution environment], [Best Practices for Working with AWS Lambda Functions]
Question #98
A company is using an Amazon API Gateway REST API endpoint as a webhook to publish events from an on-premises source control management (SCM) system to Amazon EventBridge. The company has configured an EventBridge rule to listen for the events and to control application deployment in a central AWS account. The company needs to receive the same events across multiple receiver AWS accounts.
How can a developer meet these requirements without changing the configuration of the SCM system?
- A . Deploy the API Gateway REST API to all the required AWS accounts. Use the same custom domain name for all the gateway endpoints so that a single SCM webhook can be used for all events from all accounts.
- B . Deploy the API Gateway REST API to all the receiver AWS accounts. Create as many SCM webhooks as the number of AWS accounts.
- C . Grant permission to the central AWS account for EventBridge to access the receiver AWS accounts. Add an EventBridge event bus on the receiver AWS accounts as the targets to the existing EventBridge rule.
- D . Convert the API Gateway type from REST API to HTTP API.
Correct Answer: C
Question #99
For compliance monitoring, what AWS service allows you to audit changes to AWS resources?
- A . AWS Config
- B . Amazon CloudWatch
- C . AWS CloudTrail
- D . AWS IAM
Correct Answer: A
Question #100
A company is offering APIs as a service over the internet to provide unauthenticated read access to statistical information that is updated daily. The company uses Amazon API Gateway and AWS Lambda to develop the APIs. The service has become popular, and the company wants to enhance the responsiveness of the APIs.
Which action can help the company achieve this goal?
- A . Enable API caching in API Gateway.
- B . Configure API Gateway to use an interface VPC endpoint.
- C . Enable cross-origin resource sharing (CORS) for the APIs.
- D . Configure usage plans and API keys in API Gateway.
Correct Answer: A
A
Explanation:
Amazon API Gateway is a service that enables developers to create, publish, maintain, monitor, and secure APIs at any scale. The developer can enable API caching in API Gateway to cache responses from the backend integration point for a specified time-to-live (TTL) period. This can improve the responsiveness of the APIs by reducing the number of calls made to the backend service.
Reference: [What Is Amazon API Gateway? – Amazon API Gateway]
[Enable API Caching to Enhance Responsiveness – Amazon API Gateway]
A
Explanation:
Amazon API Gateway is a service that enables developers to create, publish, maintain, monitor, and secure APIs at any scale. The developer can enable API caching in API Gateway to cache responses from the backend integration point for a specified time-to-live (TTL) period. This can improve the responsiveness of the APIs by reducing the number of calls made to the backend service.
Reference: [What Is Amazon API Gateway? – Amazon API Gateway]
[Enable API Caching to Enhance Responsiveness – Amazon API Gateway]