Amazon DVA-C02 Practice Exams
Last updated on Oct 21,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 21,2026
A company has built an AWS Lambda function to convert large image files into output files that can be used in a third-party viewer application The company recently added a new module to the function to improve the output of the generated files However, the new module has increased the bundle size and has increased the time that is needed to deploy changes to the function code.
How can a developer increase the speed of the Lambda function deployment?
- A . Use AWS CodeDeploy to deploy the function code
- B . Use Lambda layers to package and load dependencies.
- C . Increase the memory size of the function.
- D . Use Amazon S3 to host the function dependencies
B
Explanation:
Problem: Large bundle size increases Lambda deployment time.
Lambda Layers: Layers let you package dependencies separately from your function code. This optimizes the deployment package, making updates faster.
Modularization: Breaking down dependencies into layers improves code organization and reusability.
Reference: AWS Lambda Layers: https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html
A developer used the AWS SDK to create an application that aggregates and produces log records for 10 services. The application delivers data to an Amazon Kinesis Data Streams stream.
Each record contains a log message with a service name, creation timestamp, and other log information. The stream has 15 shards in provisioned capacity mode. The stream uses service name as the partition key.
The developer notices that when all the services are producing logs, ProvisionedThroughputExceededException errors occur during PutRecord requests. The stream metrics show that the write capacity the applications use is below the provisioned capacity.
- A . Change the capacity mode from provisioned to on-demand.
- B . Double the number of shards until the throttling errors stop occurring.
- C . Change the partition key from service name to creation timestamp.
- D . Use a separate Kinesis stream for each service to generate the logs.
C
Explanation:
Comprehensive and Detailed Step-by-Step
Issue Analysis:
The stream uses service name as the partition key. This can cause "hot partition" issues when a few service names generate significantly more logs compared to others, causing uneven distribution of data across shards.
Metrics show that the write capacity used is below provisioned capacity, which confirms that the throughput errors are due to shard-level limits and not overall capacity.
Option C: Change Partition Key to Creation Timestamp:
By changing the partition key to the creation timestamp (or a composite key including timestamp), the distribution of data across shards can be randomized, ensuring an even spread of records.
This resolves the shard overutilization issue and eliminates ProvisionedThroughputExceededException.
Why Other Options Are Incorrect:
Option A: Switching to on-demand capacity mode might temporarily alleviate the issue, but the root cause (hot partitioning) remains unresolved.
Option B: Adding shards increases capacity but does not fix the skewed data distribution caused by using the service name as the partition key.
Option D: Creating separate streams for each service adds unnecessary complexity and does not
scale well as the number of services grows.
Reference: Best Practices for Kinesis Data Streams Partition Key Design
A company runs a batch processing application by using AWS Lambda functions and Amazon API Gateway APIs with deployment stages for development, user acceptance testing and production A development team needs to configure the APIs in the deployment stages to connect to third-party service endpoints.
Which solution will meet this requirement?
- A . Store the third-party service endpoints in Lambda layers that correspond to the stage
- B . Store the third-party service endpoints in API Gateway stage variables that correspond to the stage
- C . Encode the third-party service endpoints as query parameters in the API Gateway request URL.
- D . Store the third-party service endpoint for each environment in AWS AppConfig
B
Explanation:
API Gateway Stage Variables: These are designed for configuring dynamic values for your APIs in different deployment stages (dev, test, prod). Here’s how to use them for third-party endpoints: In the API Gateway console, access the "Stages" section of your API.
For each stage, create a stage variable named something like thirdPartyEndpoint.
Set the value of this variable to the actual endpoint URL for that specific environment.
When configuring API requests within your API Gateway method, reference this endpoint
using ${stageVariables.thirdPartyEndpoint}.
Why Stage Variables Excel Here:
Environment Isolation: This approach keeps the endpoint configuration specific to each deployment
stage, ensuring the right endpoints are used during development, testing, and production cycles.
Ease of Management: You manage the endpoints directly through the API Gateway console without
additional infrastructure.
Reference: Amazon API Gateway Stage
Variables: https://docs.aws.amazon.com/apigateway/latest/developerguide/stage-variables.html
A company has an application that is based on Amazon EC2. The company provides API access to the application through Amazon API Gateway and uses Amazon DynamoDB to store the application’s data. A developer is investigating performance issues that are affecting the application. During peak usage, the application is overwhelmed by a large number of identical data read requests that come through APIs.
What is the MOST operationally efficient way for the developer to improve the application’s performance?
- A . Use DynamoDB Accelerator (DAX) to cache database responses.
- B . Configure Amazon EC2 Auto Scaling policies to meet fluctuating demand.
- C . Enable API Gateway caching to cache API responses.
- D . Use Amazon ElastiCache to cache application responses.
A
Explanation:
DynamoDB Accelerator (DAX) provides a managed caching layer specifically optimized for DynamoDB, reducing latency for repeated read requests.
Why Option A is Correct:
Purpose-Built: DAX is designed for DynamoDB, enabling sub-millisecond response times for frequently accessed items.
Operational Efficiency: No need for additional application-level caching logic.
Why Not Other Options:
Option B: Auto Scaling increases capacity but does not address repetitive reads.
Option C: API Gateway caching helps reduce request processing time but does not optimize DynamoDB reads.
Option D: ElastiCache is a general-purpose cache, adding unnecessary complexity for DynamoDB use
cases.
Reference: DynamoDB Accelerator (DAX)
A developer is working on a web application that uses Amazon DynamoDB as its data store. The application has two DynamoDB tables one table that is named artists and one table that is named songs The artists table has artistName as the partition key. The songs table has songName as the partition key and artistName as the sort key
The table usage patterns include the retrieval of multiple songs and artists in a single database
operation from the webpage. The developer needs a way to retrieve this information with minimal network traffic and optimal application performance.
Which solution will meet these requirements?
- A . Perform a BatchGetltem operation that returns items from the two tables. Use the list of songName artistName keys for the songs table and the list of artistName key for the artists table.
- B . Create a local secondary index (LSI) on the songs table that uses artistName as the partition key Perform a query operation for each artistName on the songs table that filters by the list of songName Perform a query operation for each artistName on the artists table
- C . Perform a BatchGetltem operation on the songs table that uses the songName/artistName keys.
Perform a BatchGetltem operation on the artists table that uses artistName as the key. - D . Perform a Scan operation on each table that filters by the list of songName/artistName for the songs table and the list of artistName in the artists table.
A
Explanation:
Scenario: Application needs to fetch songs and artists efficiently in a single operation. BatchGetItem: This DynamoDB operation retrieves multiple items across different tables based on their primary keys in a single request.
Optimized for Request Batching: This approach reduces network traffic compared to performing multiple queries individually.
Data Modeling: The songs table is designed appropriately for this access pattern using artistName as
the sort key.
Reference: Amazon DynamoDB
BatchGetItem: https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_BatchGetI tem.ht
A company has an application that uses an AWS Lambda function to process customer orders. The company notices that the application processes some orders more than once.
A developer needs to update the application to prevent duplicate processing.
Which solution will meet this requirement with the LEAST implementation effort?
- A . Implement a de-duplication mechanism that uses Amazon DynamoDB as the control database. Configure the Lambda function to check for the existence of a unique identifier before processing each event.
- B . Create a custom Amazon ECS task to perform idempotency checks. Use AWS Step Functions to integrate the ECS task with the Lambda function.
- C . Configure the Lambda function to retry failed invocations. Implement a retry mechanism that has a fixed delay between attempts to handle duplicate events.
- D . Use Amazon Athena to query processed events to identify duplicate records. Add processing logic to the Lambda function to handle the duplication scenarios that the query identifies.
A
Explanation:
Requirement Summary:
Orders are being processed more than once
Need to prevent duplicate processing
Looking for least implementation effort
Key Concept:
Lambda + Event-driven patterns can occasionally result in duplicate invocations (at-least-once delivery model)
You need idempotency (i.e., prevent repeated processing of same event)
Evaluate Options:
✅ A. Use DynamoDB for de-duplication
✅ Simple and widely used approach
Store a unique orderId as the primary key Before processing, check if order exists
If yes → skip
If no → process and store the ID
✅ Minimal code changes required B. ECS + Step Functions
❌ Overkill for basic de-duplication Adds significant complexity
C. Retry logic with fixed delay
❌ Doesn’t prevent duplication ― makes it worse Retrying might trigger the same message again D. Athena to identify duplicates
❌ Reactive solution, not preventative
Not suitable for real-time event de-duplication
Lambda idempotency: https://docs.aws.amazon.com/lambda/latest/dg/invocation-retries.html Using DynamoDB for idempotent design: https://aws.amazon.com/blogs/compute/how-to-design-idempotent-APIs-on-aws/
A developer is troubleshooting an Amazon API Gateway API Clients are receiving HTTP 400 response errors when the clients try to access an endpoint of the API.
How can the developer determine the cause of these errors?
- A . Create an Amazon Kinesis Data Firehose delivery stream to receive API call logs from API Gateway.
Configure Amazon CloudWatch Logs as the delivery stream’s destination. - B . Turn on AWS CloudTrail Insights and create a trail Specify the Amazon Resource Name (ARN) of the trail for the stage of the API.
- C . Turn on AWS X-Ray for the API stage Create an Amazon CtoudWalch Logs log group Specify the Amazon Resource Name (ARN) of the log group for the API stage.
- D . Turn on execution logging and access logging in Amazon CloudWatch Logs for the API stage. Create a CloudWatch Logs log group. Specify the Amazon Resource Name (ARN) of the log group for the API stage.
D
Explanation:
This solution will meet the requirements by using Amazon CloudWatch Logs to capture and analyze the logs from API Gateway. Amazon CloudWatch Logs is a service that monitors, stores, and accesses log files from AWS resources. The developer can turn on execution logging and access logging in Amazon CloudWatch Logs for the API stage, which enables logging information about API execution and client access to the API. The developer can create a CloudWatch Logs log group, which is a collection of log streams that share the same retention, monitoring, and access control settings. The developer can specify the Amazon Resource Name (ARN) of the log group for the API stage, which instructs API Gateway to send the logs to the specified log group. The developer can then examine the logs to determine the cause of the HTTP 400 response errors.
Option A is not optimal because it will create an Amazon Kinesis Data Firehose delivery stream to receive API call logs from API Gateway, which may introduce additional costs and complexity for delivering and processing streaming data.
Option B is not optimal because it will turn on AWS CloudTrail Insights and create a trail, which is a feature that helps identify and troubleshoot unusual API activity or operational issues, not HTTP response errors.
Option C is not optimal because it will turn on AWS X-Ray for the API stage, which is a service that helps analyze and debug distributed applications, not HTTP response errors.
Reference: [Setting Up CloudWatch Logging for a REST API], [CloudWatch Logs Concepts]
A company has many microservices that are comprised of AWS Lambda functions. Multiple teams
within the company split ownership of the microservices.
An application reads configuration values from environment variables that are contained in the Lambda functions. During a security audit, the company discovers that some of the environment variables contain sensitive information.
The company’s security policy requires each team to have full control over the rotation of AWS KMS keys that the team uses for its respective microservices.
- A . Create AWS managed keys for all Lambda functions. Use the new AWS managed keys to encrypt the environment variables. Add kms:Decrypt permissions to the Lambda function execution roles.
- B . Create customer managed keys for all Lambda functions. Use the new customer managed keys to encrypt the environment variables. Add kms:Decrypt permission to the Lambda function execution roles.
- C . Create customer managed keys for all Lambda functions. Use the new customer managed keys to encrypt the environment variables. Add kms:CreateGrant permission and kms:Encrypt permission to the Lambda function execution roles.
- D . Create AWS managed keys for all Lambda functions. Use the new AWS managed keys to encrypt the environment variables. Add kms:CreateGrant permission and kms:Encrypt permission to the Lambda function execution roles.
B
Explanation:
Comprehensive and Detailed Step-by-Step
Customer Managed Keys (CMK) for Granular Control (Option B): Customer-managed KMS keys are required to meet the security policy requirement of team-specific control over KMS key rotation. Each team can manage the lifecycle of its own key.
The kms:Decrypt permission allows the Lambda function execution roles to decrypt the environment variables during runtime.
This solution adheres to the principle of least privilege and satisfies the need for team-specific key control.
Why Other Options Are Incorrect:
Option A: AWS-managed keys cannot provide team-specific control or support the custom rotation policy required by the teams.
Option C: Adding kms:CreateGrant and kms:Encrypt permissions to Lambda roles is unnecessary for this scenario. The key usage is limited to decryption at runtime.
Option D: AWS-managed keys still lack team-specific control, and adding kms:CreateGrant and kms:Encrypt is redundant.
Reference: AWS Lambda Environment Variables
AWS Key Management Service Documentation
A developer has observed an increase in bugs in the AWS Lambda functions that a development team has deployed in its Node is application. To minimize these bugs, the developer wants to impendent automated testing of Lambda functions in an environment that Closely simulates the Lambda environment.
The developer needs to give other developers the ability to run the tests locally. The developer also needs to integrate the tests into the team’s continuous integration and continuous delivery (Ct/CO) pipeline before the AWS Cloud Development Kit (AWS COK) deployment.
Which solution will meet these requirements?
- A . Create sample events based on the Lambda documentation. Create automated test scripts that use the cdk local invoke command to invoke the Lambda functions. Check the response Document the test scripts for the other developers on the team Update the CI/CD pipeline to run the test scripts.
- B . Install a unit testing framework that reproduces the Lambda execution environment. Create sample events based on the Lambda Documentation Invoke the handler function by using a unit testing framework. Check the response Document how to run the unit testing framework for the other developers on the team. Update the OCD pipeline to run the unit testing framework.
- C . Install the AWS Serverless Application Model (AWS SAW) CLI tool Use the Sam local generate-event command to generate sample events for me automated tests. Create automated test scripts that use the Sam local invoke command to invoke the Lambda functions. Check the response Document the test scripts tor the other developers on the team Update the CI/CD pipeline to run the test scripts.
- D . Create sample events based on the Lambda documentation. Create a Docker container from the Node is base image to invoke the Lambda functions. Check the response Document how to run the Docker container for the more developers on the team update the CI/CD pipeline to run the Docker container.
C
Explanation:
This solution will meet the requirements by using AWS SAM CLI tool, which is a command line tool that lets developers locally build, test, debug, and deploy serverless applications defined by AWS SAM templates. The developer can use sam local generate-event command to generate sample events for different event sources such as API Gateway or S3. The developer can create automated test scripts that use sam local invoke command to invoke Lambda functions locally in an environment that closely simulates Lambda environment. The developer can check the response from Lambda functions and document how to run the test scripts for other developers on the team. The developer can also update CI/CD pipeline to run these test scripts before deploying with AWS CDK.
Option A is not optimal because it will use cdk local invoke command, which does not exist in AWS CDK CLI tool.
Option B is not optimal because it will use a unit testing framework that reproduces Lambda execution environment, which may not be accurate or consistent with Lambda environment.
Option D is not optimal because it will create a Docker container from Node.js base image to invoke Lambda functions, which may introduce additional overhead and complexity for creating and running Docker containers.
Reference: [AWS Serverless Application Model (AWS SAM)], [AWS Cloud Development Kit (AWS CDK)]
A company has an existing application that has hardcoded database credentials A developer needs to modify the existing application The application is deployed in two AWS Regions with an active-passive failover configuration to meet company’s disaster recovery strategy The developer needs a solution to store the credentials outside the code. The solution must comply With the company’s disaster recovery strategy
Which solution Will meet these requirements in the MOST secure way?
- A . Store the credentials in AWS Secrets Manager in the primary Region. Enable secret replication to the secondary Region Update the application to use the Amazon Resource Name (ARN) based on the Region.
- B . Store credentials in AWS Systems Manager Parameter Store in the primary Region. Enable parameter replication to the secondary Region. Update the application to use the Amazon Resource Name (ARN) based on the Region.
- C . Store credentials in a config file. Upload the config file to an S3 bucket in me primary Region. Enable Cross-Region Replication (CRR) to an S3 bucket in the secondary region. Update the application to access the config file from the S3 bucket based on the Region.
- D . Store credentials in a config file. Upload the config file to an Amazon Elastic File System (Amazon EFS) file system. Update the application to use the Amazon EFS file system Regional endpoints to access the config file in the primary and secondary Regions.
A
Explanation:
AWS Secrets Manager is a service that allows you to store and manage secrets, such as database credentials, API keys, and passwords, in a secure and centralized way. It also provides features such as automatic secret rotation, auditing, and monitoring1. By using AWS Secrets Manager, you can avoid hardcoding credentials in your code, which is a bad security practice and makes it difficult to update them. You can also replicate your secrets to another Region, which is useful for disaster recovery purposes2. To access your secrets from your application, you can use the ARN of the secret, which is a unique identifier that includes the Region name. This way, your application can use the appropriate secret based on the Region where it is deployed3.
Reference: AWS Secrets Manager
Replicating and sharing secrets
Using your own encryption keys