Amazon DVA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
An ecommerce company is using an AWS Lambda function behind Amazon API Gateway as its application tier. To process orders during checkout, the application calls a POST API from the frontend. The POST API invokes the Lambda function asynchronously. In rare situations, the application has not processed orders. The Lambda application logs show no errors or failures.
What should a developer do to solve this problem?
- A . Inspect the frontend logs for API failures. Call the POST API manually by using the requests from the log file.
- B . Create and inspect the Lambda dead-letter queue. Troubleshoot the failed functions. Reprocess the events.
- C . Inspect the Lambda logs in Amazon CloudWatch for possible errors. Fix the errors.
- D . Make sure that caching is disabled for the POST API in API Gateway.
B
Explanation:
The solution that will solve this problem is to create and inspect the Lambda dead-letter queue. Troubleshoot the failed functions. Reprocess the events. This way, the developer can identify and fix any issues that caused the Lambda function to fail when invoked asynchronously by API Gateway. The developer can also reprocess any orders that were not processed due to failures. The other options either do not address the root cause of the problem, or do not help recover from failures.
Reference: Asynchronous invocation
A developer supports an application that accesses data in an Amazon DynamoDB table. One of the item attributes is expiration Date in the timestamp format. The application uses this attribute to find items, archive them, and remove them from the table based on the timestamp value
The application will be decommissioned soon, and the developer must find another way to implement this functionality. The developer needs a solution that will require the least amount of code to write.
Which solution will meet these requirements?
- A . Enable TTL on the expirationDate attribute in the table. Create a DynamoDB stream. Create an AWS Lambda function to process the deleted items. Create a DynamoDB trigger for the Lambda function.
- B . Create two AWS Lambda functions one to delete the items and one to process the items Create a DynamoDB stream Use the Deleteltem API operation to delete the items based on the expirationDate attribute Use the GetRecords API operation to get the items from the DynamoDB stream and process them
- C . Create two AWS Lambda functions, one to delete the items and one to process the items. Create an Amazon EventBndge scheduled rule to invoke the Lambda Functions Use the Deleteltem API operation to delete the items based on the expirationDate attribute. Use the GetRecords API operation to get the items from the DynamoDB table and process them.
- D . Enable TTL on the expirationDate attribute in the table Specify an Amazon Simple Queue Service (Amazon SQS> dead-letter queue as the target to delete the items Create an AWS Lambda function to process the items
A
Explanation:
TTL for Automatic Deletion: DynamoDB’s Time-to-Live effortlessly deletes expired items without manual intervention.
DynamoDB Stream: Captures changes to the table, including deletions of expired items, triggering downstream actions.
Lambda for Processing: A Lambda function connected to the stream provides custom logic for handling the deleted items.
Code Efficiency: This solution leverages native DynamoDB features and stream-based processing, minimizing the need for custom code.
Reference: DynamoDB TTL
Documentation: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/TTL.html DynamoDB Streams
Documentation: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.h tml
A company is developing a serverless application by using AWS Lambda functions. One of the Lambda functions needs to access an Amazon RDS DB instance. The DB instance is in a private subnet inside a VPC.
The company creates a role that includes the necessary permissions to access the DB instance. The company then assigns the role to the Lambda function. A developer must take additional action to give the Lambda function access to the DB instance.
What should the developer do to meet these requirements?
- A . Assign a public IP address to the DB instance. Modify the security group of the DB instance to allow inbound traffic from the IP address of the Lambda function.
- B . Set up an AWS Direct Connect connection between the Lambda function and the DB instance.
- C . Configure an Amazon CloudFront distribution to create a secure connection between the Lambda function and the DB instance.
- D . Configure the Lambda function to connect to the private subnets in the VPC. Add security group rules to allow traffic to the DB instance from the Lambda function.
A developer has written an AWS Lambda function. The function is CPU-bound. The developer wants to ensure that the function returns responses quickly.
How can the developer improve the function’s performance?
- A . Increase the function’s CPU core count.
- B . Increase the function’s memory.
- C . Increase the function’s reserved concurrency.
- D . Increase the function’s timeout.
B
Explanation:
The amount of memory you allocate to your Lambda function also determines how much CPU and network bandwidth it gets. Increasing the memory size can improve the performance of CPU-bound functions by giving them more CPU power. The CPU allocation is proportional to the memory allocation, so a function with 1 GB of memory has twice the CPU power of a function with 512 MB of memory.
Reference: AWS Lambda execution environment
A developer is building a web and mobile application for two types of users: regular users and guest users. Regular users are required to log in, but guest users do not log in. Users should see only their data, regardless of whether they authenticate. Users need AWS credentials before they can access AWS resources.
- A . Use an Amazon Cognito identity pool to generate temporary AWS credentials that are linked to an unauthenticated role that has access to the required resources.
- B . Set up an IAM user that has permissions to the required resources. Hardcode the IAM credentials in the web and mobile application.
- C . Generate temporary keys that are stored in AWS KMS. Use the temporary keys to access the required resources.
- D . Generate temporary credentials. Store the temporary credentials in AWS Secrets Manager. Use the temporary credentials to access the required resources.
A
Explanation:
Comprehensive and Detailed Step-by-Step
Option A: Amazon Cognito Identity Pool with Unauthenticated Role
Cognito identity pools can generate temporary AWS credentials for both authenticated and unauthenticated users.
For guest users, Cognito assigns an unauthenticated role with limited permissions, ensuring secure access to only their resources.
This is the most secure and efficient solution for managing AWS credentials dynamically without hardcoding or storing them.
Why Other Options Are Incorrect:
Option B: Hardcoding IAM credentials in the application is insecure and violates best practices.
Option C and D: Temporary keys stored in KMS or Secrets Manager require additional implementation overhead and do not inherently manage user-specific access.
Reference: Amazon Cognito Identity Pools
A developer is using AWS CodeDeploy to automate a company’s application deployments to Amazon EC2.
Which application specification file properties are required to ensure the software deployments do not fail? (Select TWO.)
- A . The file must be a JSON-formatted file named appspec.json.
- B . The file must be a YAML-formatted file named appspec.yml.
- C . The file must be stored in AWS CodeBuild and referenced from the application’s source code.
- D . The file must be placed in the root of the directory structure of the application’s source code.
- E . The file must be stored in Amazon S3 and referenced from the application’s source code.
B, D
Explanation:
Comprehensive and Detailed Step-by-Step
To ensure successful software deployments using AWS CodeDeploy, the application specification file (appspec.yml or appspec.json) must adhere to specific requirements: File Format Requirement (Option B):
The appspec.yml file is a YAML-formatted file required for defining deployment actions and file locations. This is the modern and recommended format for application specification files.
It can also be a JSON-formatted file named appspec.json, but YAML is most commonly used and accepted.
File Placement Requirement (Option D):
The application specification file must reside in the root directory of the application’s source code. This is necessary so that AWS CodeDeploy can detect and use the file during deployment.
Incorrect Options:
Option A: While a JSON-formatted file (appspec.json) is valid, this is not a mandatory requirement.
YAML is also acceptable, and this option does not account for it.
Option C: The application specification file is not required to be stored in AWS CodeBuild; it must be included in the source code’s directory structure.
Option E: The application specification file does not need to be stored in Amazon S3. S3 is commonly used for application artifacts, but the appspec.yml or appspec.json file must exist within the deployment package or source code root.
Reference: AWS CodeDeploy User Guide: Application Specification File
A developer is creating an AWS Lambda function that searches for items from an Amazon DynamoDB table that contains customer contact information- The DynamoDB table items have the customer’s email_address as the partition key and additional properties such as customer_type, name, and job_tltle.
The Lambda function runs whenever a user types a new character into the customer_type text input The developer wants the search to return partial matches of all the email_address property of a particular customer_type The developer does not want to recreate the DynamoDB table.
What should the developer do to meet these requirements?
- A . Add a global secondary index (GSI) to the DynamoDB table with customer_type as the partition key and email_address as the sort key Perform a query operation on the GSI by using the begvns_wth key condition expression With the emad_address property
- B . Add a global secondary index (GSI) to the DynamoDB table With ernail_address as the partition key and customer_type as the sort key Perform a query operation on the GSI by using the begins_wtth key condition expression With the emal_address property.
- C . Add a local secondary index (LSI) to the DynamoDB table With customer_type as the partition key and email_address as the sort key Perform a query operation on the LSI by using the begins_wlth key condition expression With the email_address property
- D . Add a local secondary Index (LSI) to the DynamoDB table With job_tltle as the partition key and emad_address as the sort key Perform a query operation on the LSI by using the begins_wrth key condition expression With the email_address property
A
Explanation:
Understand the Problem: The existing DynamoDB table has email_address as the partition key. Searching by customer_type requires a different data access pattern. We need an efficient way to query for partial matches on email_address based on customer_type.
Why Global Secondary Index (GSI):
GSIs allow you to define a different partition key and sort key from the main table, enabling new query patterns.
In this case, having customer_type as the GSI’s partition key lets you group all emails with the same customer type together.
Using email_address as the sort key allows ordering within each customer type, facilitating the
partial matching.
Querying the GSI:
You’ll perform a query operation on the GSI, not the original table.
Use the begins_with key condition expression on the GSI’s sort key (email_address) to find partial matches as the user types in the customer_type field.
Reference: DynamoDB Global Secondary
Indexes: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GSI.html
DynamoDB Query Operation: [invalid URL removed]
Key Condition Expressions: [invalid URL removed]
A developer has been asked to create an AWS Lambda function that is invoked any time updates are made to items in an Amazon DynamoDB table. The function has been created and appropriate permissions have been added to the Lambda execution role Amazon DynamoDB streams have been enabled for the table, but the function 15 still not being invoked.
Which option would enable DynamoDB table updates to invoke the Lambda function?
- A . Change the StreamViewType parameter value to NEW_AND_OLOJMAGES for the DynamoDB table.
- B . Configure event source mapping for the Lambda function.
- C . Map an Amazon Simple Notification Service (Amazon SNS) topic to the DynamoDB streams.
- D . Increase the maximum runtime (timeout) setting of the Lambda function.
B
Explanation:
This solution allows the Lambda function to be invoked by the DynamoDB stream whenever updates are made to items in the DynamoDB table. Event source mapping is a feature of Lambda that enables a function to be triggered by an event source, such as a DynamoDB stream, an Amazon Kinesis stream, or an Amazon Simple Queue Service (SQS) queue. The developer can configure event source mapping for the Lambda function using the AWS Management Console, the AWS CLI, or the AWS SDKs. Changing the StreamViewType parameter value to NEW_AND_OLD_IMAGES for the DynamoDB table will not affect the invocation of the Lambda function, but only change the information that is written to the stream record. Mapping an Amazon Simple Notification Service (Amazon SNS) topic to the DynamoDB stream will not invoke the Lambda function directly, but require an additional subscription from the Lambda function to the SNS topic. Increasing the maximum runtime (timeout) setting of the Lambda function will not affect the invocation of the Lambda function, but only change how long the function can run before it is terminated.
Reference: [Using AWS Lambda with Amazon DynamoDB], [Using AWS Lambda with Amazon SNS]
A company notices that credentials that the company uses to connect to an external software as a service (SaaS) vendor are stored in a configuration file as plaintext.
The developer needs to secure the API credentials and enforce automatic credentials rotation on a quarterly basis.
Which solution will meet these requirements MOST securely?
- A . Use AWS Key Management Service (AWS KMS) to encrypt the configuration file. Decrypt the configuration file when users make API calls to the SaaS vendor. Enable rotation.
- B . Retrieve temporary credentials from AWS Security Token Service (AWS STS) every 15 minutes. Use the temporary credentials when users make API calls to the SaaS vendor.
- C . Store the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access.
- D . Store the credentials in AWS Systems Manager Parameter Store and enable rotation. Retrieve the credentials when users make API calls to the SaaS vendor.
C
Explanation:
Store the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access. This is correct. This solution will meet the requirements most securely, because it uses a service that is designed to store and manage secrets such as API credentials. AWS Secrets Manager helps you protect access to your applications, services, and IT resources by enabling you to rotate, manage, and retrieve secrets throughout their lifecycle1. You can store secrets such as passwords, database strings, API keys, and license codes as encrypted values2. You can also configure automatic rotation of your secrets on a schedule that you specify3. You can use the AWS SDK or CLI to retrieve secrets from Secrets Manager when you need them4. This way, you can avoid storing credentials in plaintext files or hardcoding them in your code.
A developer has a financial application. The application uses AWS Secrets Manager to manage an Amazon RDS for PostgreSQL database’s username and password. The developer needs to rotate the password while maintaining the application’s high availability.
Which solution will meet these requirements with LEAST development effort?
- A . Rotate the secret by using the alternating-users rotation strategy. Update the application with an appropriate retry strategy to handle authentication failures.
- B . Use the PostgreSQL client to create a new database username and password. Include the new secret values by performing an immediate rotation. Use the AWS CLI to update the RDS database password. Perform an immediate rotation of the Secrets Manager secrets.
- C . Rotate the secret by using multivalue answer rotation. Update the application with an appropriate retry strategy to handle authentication failures.
- D . Rotate the secret by using the single-user rotation strategy. Update the application with an appropriate retry strategy to handle authentication failures.
D
Explanation:
Requirement Summary:
Secrets managed in AWS Secrets Manager
DB: Amazon RDS for PostgreSQL
Need automated password rotation
Must maintain high availability
Least development effort
Rotation Strategies:
✅ Single-user rotation strategy
✅ Simplest to implement
The secret contains one set of credentials used by app and rotation logic
✅ Supports automated rotation
AWS provides built-in Lambda rotation templates for RDS