Amazon DVA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A company had an Amazon RDS for MySQL DB instance that was named mysql-db. The DB instance was deleted within the past 90 days. A developer needs to find which 1AM user or role deleted the DB instance in the AWS environment.
Which solution will provide this information?
- A . Retrieve the AWS CloudTrail events for the resource mysql-db where the event name is DeleteDBInstance. Inspect each event.
- B . Retrieve the Amazon CloudWatch log events from the most recent log stream within the rds/mysql-db log group. Inspect the log events.
- C . Retrieve the AWS X-Ray trace summaries. Filter by services with the name mysql-db. Inspect the ErrorRootCauses values within each summary.
- D . Retrieve the AWS Systems Manager deletions inventory Filter the inventory by deletions that have a TypeName value of RDS. Inspect the deletion details.
A company is creating a new application that gives users the ability to upload and share short video files. The average size of the video files is 10 MB. After a user uploads a file, a message needs to be placed into an Amazon Simple Queue Service (Amazon SQS) queue so the file can be processed. The files need to be accessible for processing within 5 minutes.
Which solution will meet these requirements MOST cost-effectively?
- A . Write the files to Amazon S3 Glacier Deep Archive. Add the S3 location of the files to the SQS queue.
- B . Write the files to Amazon S3 Standard. Add the S3 location of the files to the SQS queue.
- C . Write the files to an Amazon Elastic Block Store (Amazon EBS) General Purpose SSD volume. Add the EBS location of the files to the SQS queue.
- D . Write messages that contain the contents of the uploaded files to the SQS queue.
B
Explanation:
Why Option B is Correct:
Amazon S3 Standard provides immediate access to files and is cost-effective for files that need to be accessed within 5 minutes.
By adding the S3 location to the SQS queue, you avoid transferring large files directly, which is both more efficient and scalable.
Why Other Options are Incorrect:
Option A: S3 Glacier Deep Archive is designed for archival storage with retrieval times ranging from minutes to hours, which does not meet the 5-minute requirement.
Option C: Amazon EBS is designed for block storage attached to EC2 instances, which adds unnecessary complexity and cost.
Option D: SQS is not designed to handle large file content directly and has message size limits (256 KB).
AWS Documentation
Reference: Amazon S3 Overview
Amazon SQS Best Practices
A company uses an AWS Lambda function to transfer files from an Amazon S3 bucket to the company’s SFTP server. The Lambda function connects to the SFTP server by using credentials such as username and password. The company uses Lambda environment variables to store these credentials.
A developer needs to implement encrypted username and password credentials.
Which solution will meet these requirements?
- A . Remove the user credentials from the Lambda environment. Implement 1AM database authentication.
- B . Move the user credentials from Lambda environment variables to AWS Systems Manager
Parameter Store. - C . Move the user credentials from Lambda environment variables to AWS Key Management Service (AWS KMS).
- D . Move the user credentials from the Lambda environment to an encrypted .txt file. Store the file in an S3 bucket.
A company uses an AWS Lambda function to transfer files from an Amazon S3 bucket to the company’s SFTP server. The Lambda function connects to the SFTP server by using credentials such as username and password. The company uses Lambda environment variables to store these credentials.
A developer needs to implement encrypted username and password credentials.
Which solution will meet these requirements?
- A . Remove the user credentials from the Lambda environment. Implement 1AM database authentication.
- B . Move the user credentials from Lambda environment variables to AWS Systems Manager
Parameter Store. - C . Move the user credentials from Lambda environment variables to AWS Key Management Service (AWS KMS).
- D . Move the user credentials from the Lambda environment to an encrypted .txt file. Store the file in an S3 bucket.
A company is concerned that a malicious user could deploy unauthorized changes to the code for an AWS Lambda function.
What can a developer do to ensure that only trusted code is deployed to Lambda?
- A . Turn on the trusted code option in AWS CodeDeploy. Add the CodeDeploy digital certificate to the Lambda package before deploying the package to Lambda.
- B . Define the code signing configuration in the Lambda console. Use AWS Signer to digitally sign the Lambda package before deploying the package to Lambda.
- C . Link Lambda to AWS KMS in the Lambda console. Use AWS KMS to digitally sign the Lambda package before deploying the package to Lambda.
- D . Set the KmsKeyArn property of the Lambda function to the Amazon Resource Name (ARN) of a trusted key before deploying the package to Lambda.
B
Explanation:
Requirement Summary:
Prevent unauthorized code changes in AWS Lambda
Ensure only trusted code is deployed
✅ AWS Lambda supports Code Signing:
You can configure code signing in Lambda using AWS Signer
Packages must be digitally signed and verified against the signing profile
Rejects unauthorized/modified packages automatically
Evaluate Options:
A development team is creating a serverless application that uses AWS Lambda functions. The team wants to streamline a testing workflow by sharing test events across multiple developers within the same AWS account. The team wants to ensure all developers can use consistent test events without compromising security.
- A . Export test events as JSON files. Store the files in an Amazon S3 bucket. Configure granular IAM permissions to allow the developers to access the S3 bucket.
- B . Store test events in an Amazon DynamoDB table. Create an AWS Lambda function to retrieve shared test events for the developers.
- C . Configure test events to be shareable. Configure granular IAM permissions to allow the developers to access shared test events.
- D . Set up a Git repository to store test events. Provide the developers with access to the repository.
A
Explanation:
Comprehensive and Detailed Step-by-Step
Option A: Use Amazon S3 for Shared Test Events:
Storing JSON test event files in an S3 bucket provides a centralized, cost-effective, and highly available solution.
Granular IAM policies can restrict access to specific developers or roles, ensuring security while maintaining consistency for shared test events.
This solution has minimal operational overhead and integrates easily with existing workflows.
Why Other Options Are Incorrect:
Option B: Using DynamoDB and a Lambda function introduces unnecessary complexity for a relatively simple requirement. S3 provides a simpler and more cost-efficient solution.
Option C: AWS Lambda test events are not inherently shareable across developers, making this option invalid.
Option D: Using a Git repository adds operational overhead and requires developers to clone/update repositories for access, which is more cumbersome compared to S3.
Reference: Amazon S3 for Centralized Storage
In AWS, what is the best practice for deploying an application across multiple Availability Zones?
- A . Use Elastic Load Balancing
- B . Deploy in a single zone and replicate to others manually
- C . Use Amazon RDS multi-AZ deployments
- D . All of the above
A bookstore has an ecommerce website that stores order information in an Amazon DynamoDB table named BookOrders. The DynamoDB table contains approximately one million records. The table uses OrderID as a partition key. There are no other indexes.
A developer wants to build a new reporting feature to retrieve all records from the table for a specified customer, based on a CustomerID property.
- A . Create a DynamoDB global secondary index (GSI) on the table. Use CustomerID as the partition key. Use the specified CustomerID value to run a query on the table.
- B . Create a DynamoDB global secondary index (GSI) on the table. Use CustomerID as the sort key.
Use a filter expression to perform a scan operation on the table to match on the specified
CustomerID value. - C . Create a DynamoDB local secondary index (LSI) on the table. Use CustomerID as the sort key. Run a PartiQL query on the table with a SELECT statement where CustomerID equals the specified CustomerID value.
- D . Create a DynamoDB local secondary index (LSI) on the table. Use CustomerID as the partition key.
Use the specified CustomerID value to run a query on the table.
A
Explanation:
Comprehensive and Detailed Step-by-Step
The requirement is to query records by CustomerID, which is not the current partition key (OrderID).
To achieve this efficiently:
Option A: Create a GSI with CustomerID as the Partition Key:
A Global Secondary Index (GSI) allows developers to create a different partition key and optional sort key for querying the data.
By creating a GSI with CustomerID as the partition key, the developer can query the table efficiently using CustomerID as the primary lookup key.
This avoids scanning the entire table and matches the requirement.
Why Other Options Are Incorrect:
Option B: Using CustomerID as a sort key for the GSI and performing a scan operation is inefficient.
Queries are optimized, but scans are not.
Option C and D: Local Secondary Indexes (LSI) are only valid when the partition key remains the same
as the base table. Since OrderID is the base table’s partition key, using CustomerID as the partition
key or sort key in an LSI is not valid.
Reference: Amazon DynamoDB Documentation: GSIs
A company uses a custom root certificate authority certificate chain (Root CA Cert) that is 10 KB in size generate SSL certificates for its on-premises HTTPS endpoints. One of the company’s cloud based applications has hundreds of AWS Lambda functions that pull date from these endpoints. A developer updated the trust store of the Lambda execution environment to use the Root CA Cert when the Lambda execution environment is initialized. The developer bundled the Root CA Cert as a text file in the Lambdas deployment bundle.
After 3 months of development the root CA Cert is no longer valid and must be updated. The developer needs a more efficient solution to update the Root CA Cert for all deployed Lambda functions. The solution must not include rebuilding or updating all Lambda functions that use the Root CA Cert. The solution must also work for all development, testing and production environment. Each environment is managed in a separate AWS account.
When combination of steps Would the developer take to meet these environments MOST cost-effectively? (Select TWO)
- A . Store the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret
- B . Store the Root CA Cert as a Secure Sting parameter in aws Systems Manager Parameter Store Create a resource-based policy. Add IAM users to allow access to the policy.
- C . Store the Root CA Cert in an Amazon S3 bucket. Create a resource- based policy to allow access to the bucket.
- D . Refactor the Lambda code to load the Root CA Cert from the Root CA Certs location. Modify the runtime trust store inside the Lambda function handler.
- E . Refactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store outside the Lambda function handler.
BE
Explanation:
This solution will meet the requirements by storing the Root CA Cert as a Secure String parameter in AWS Systems Manager Parameter Store, which is a secure and scalable service for storing and managing configuration data and secrets. The resource-based policy will allow IAM users in different AWS accounts and environments to access the parameter without requiring cross-account roles or permissions. The Lambda code will be refactored to load the Root CA Cert from the parameter store and modify the runtime trust store outside the Lambda function handler, which will improve performance and reduce latency by avoiding repeated calls to Parameter Store and trust store modifications for each invocation of the Lambda function.
Option A is not optimal because it will use AWS Secrets Manager instead of AWS Systems Manager Parameter Store, which will incur additional costs and complexity for storing and managing a non-secret configuration data such as Root CA Cert.
Option C is not optimal because it will deactivate the application secrets and monitor the application error logs temporarily, which will cause application downtime and potential data loss.
Option D is not optimal because it will modify the runtime trust store inside the Lambda function handler, which will degrade performance and increase latency by repeating unnecessary operations for each invocation of the Lambda function.
Reference: AWS Systems Manager Parameter Store, [Using SSL/TLS to Encrypt a Connection to a DB Instance]
A developer is troubleshooting a three-tier application, which is deployed on Amazon EC2 instances.
There is a connectivity problem between the application servers and the database servers.
Which AWS services or tools should be used to identify the faulty component? (Select TWO.)
- A . AWS CloudTrail
- B . AWS Trusted Advisor
- C . Amazon VPC Flow Logs
- D . Network access control lists
- E . AWS Config rules