Amazon DVA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A developer created an AWS Lambda function that performs a series of operations that involve multiple AWS services. The function’s duration time is higher than normal. To determine the cause of the issue, the developer must investigate traffic between the services without changing the function code
Which solution will meet these requirements?
- A . Enable AWS X-Ray active tracing in the Lambda function Review the logs in X-Ray
- B . Configure AWS CloudTrail View the trail logs that are associated with the Lambda function.
- C . Review the AWS Config logs in Amazon Cloud Watch.
- D . Review the Amazon CloudWatch logs that are associated with the Lambda function.
A
Explanation:
Tracing Distributed Systems: AWS X-Ray is designed to trace requests across services, helping identify bottlenecks in distributed applications like this one.
No Code Changes: Enabling X-Ray tracing often requires minimal code changes, meeting the requirement.
Identifying Bottlenecks: Analyzing X-Ray traces and logs will reveal latency in communications between different AWS services, leading to the high duration time.
Reference: AWS X-Ray: https://aws.amazon.com/xray/
X-Ray and Lambda: https://docs.aws.amazon.com/xray/latest/devguide/xray-services-lambda.html
A developer at a company needs to create a small application mat makes the same API call once each flay at a designated time. The company does not have infrastructure in the AWS Cloud yet, but the company wants to implement this functionality on AWS.
Which solution meets these requirements in the MOST operationally efficient manner?
- A . Use a Kubermetes cron job that runs on Amazon Elastic Kubemetes Sen/ice (Amazon EKS)
- B . Use an Amazon Linux crontab scheduled job that runs on Amazon EC2
- C . Use an AWS Lambda function that is invoked by an Amazon EventBridge scheduled event.
- D . Use an AWS Batch job that is submitted to an AWS Batch job queue.
C
Explanation:
This solution meets the requirements in the most operationally efficient manner because it does not require any infrastructure provisioning or management. The developer can create a Lambda function that makes the API call and configure an EventBridge rule that triggers the function once a day at a designated time. This is a serverless solution that scales automatically and only charges for the execution time of the function.
Reference: [Using AWS Lambda with Amazon EventBridge], [Schedule Expressions for Rules]
An ecommerce company is planning to migrate an on-premises Microsoft SQL Server database to the AWS Cloud. The company needs to migrate the database to SQL Server Always On availability groups.
The cloud-based solution must be highly available.
Which solution will meet these requirements?
- A . Deploy three Amazon EC2 instances with SQL Server across three Availability Zones. Attach one Amazon Elastic Block Store (Amazon EBS) volume to the EC2 instances.
- B . Migrate the database to Amazon RDS for SQL Server. Configure a Multi-AZ deployment and read replicas.
- C . Deploy three Amazon EC2 instances with SQL Server across three Availability Zones. Use Amazon FSx for Windows File Server as the storage tier.
- D . Deploy three Amazon EC2 instances with SQL Server across three Availability Zones. Use Amazon S3 as the storage tier.
C
Explanation:
Why Option C is Correct:
SQL Server Always On availability groups require a shared storage solution. Amazon FSx for Windows File Server provides the shared storage necessary to implement Always On availability groups in a highly available configuration.
Why Other Options are Incorrect:
Option A: A single EBS volume cannot provide shared storage for Always On availability groups.
Option B: RDS does not support SQL Server Always On availability groups.
Option D: S3 is not a suitable storage tier for SQL Server database operations.
AWS Documentation
Reference: Amazon FSx for Windows File Server
A company is using AWS CloudFormation to deploy a two-tier application. The application will use Amazon RDS as its backend database. The company wants a solution that will randomly generate the database password during deployment. The solution also must automatically rotate the database password without requiring changes to the application.
What is the MOST operationally efficient solution that meets these requirements?
- A . Use an AWS Lambda function as a CloudFormation custom resource to generate and rotate the password.
- B . Use an AWS Systems Manager Parameter Store resource with the SecureString data type to generate and rotate the password.
- C . Use a cron daemon on the application s host to generate and rotate the password.
- D . Use an AWS Secrets Manager resource to generate and rotate the password.
D
Explanation:
This solution will meet the requirements by using AWS Secrets Manager, which is a service that helps protect secrets such as database credentials by encrypting them with AWS Key Management Service (AWS KMS) and enabling automatic rotation of secrets. The developer can use an AWS Secrets Manager resource in AWS CloudFormation template, which enables creating and managing secrets as part of a CloudFormation stack. The developer can use an AWS::SecretsManager::Secret resource type to generate and rotate the password for accessing RDS database during deployment. The developer can also specify a RotationSchedule property for the secret resource, which defines
how often to rotate the secret and which Lambda function to use for rotation logic.
Option A is not optimal because it will use an AWS Lambda function as a CloudFormation custom resource, which may introduce additional complexity and overhead for creating and managing a custom resource and implementing rotation logic.
Option B is not optimal because it will use an AWS Systems Manager Parameter Store resource with the SecureString data type, which does not support automatic rotation of secrets.
Option C is not optimal because it will use a cron daemon on the application’s host to generate and rotate the password, which may incur more costs and require more maintenance for running and securing a host.
Reference: [AWS Secrets Manager], [AWS::SecretsManager::Secret]
A developer is modifying an existing AWS Lambda function White checking the code the developer notices hardcoded parameter various for an Amazon RDS for SQL Server user name password database host and port. There also are hardcoded parameter values for an Amazon DynamoOB table. an Amazon S3 bucket, and an Amazon Simple Notification Service (Amazon SNS) topic.
The developer wants to securely store the parameter values outside the code m an encrypted format and wants to turn on rotation for the credentials. The developer also wants to be able to reuse the parameter values from other applications and to update the parameter values without modifying code.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Create an RDS database secret in AWS Secrets Manager. Set the user name password, database, host and port. Turn on secret rotation. Create encrypted Lambda environment variables for the DynamoDB table, S3 bucket and SNS topic.
- B . Create an RDS database secret in AWS Secrets Manager. Set the user name password, database, host and port. Turn on secret rotation. Create Secure String parameters in AWS Systems Manager Parameter Store for the DynamoDB table, S3 bucket and SNS topic.
- C . Create RDS database parameters in AWS Systems Manager Parameter. Store for the user name password, database, host and port. Create encrypted Lambda environment variables for me DynamoDB table, S3 bucket, and SNS topic. Create a Lambda function and set the logic for the credentials rotation task Schedule the credentials rotation task in Amazon EventBridge.
- D . Create RDS database parameters in AWS Systems Manager Parameter. Store for the user name
password database, host, and port. Store the DynamoDB table. S3 bucket, and SNS topic in Amazon S3 Create a Lambda function and set the logic for the credentials rotation Invoke the Lambda function on a schedule.
B
Explanation:
This solution will meet the requirements by using AWS Secrets Manager and AWS Systems Manager Parameter Store to securely store the parameter values outside the code in an encrypted format. AWS Secrets Manager is a service that helps protect secrets such as database credentials by encrypting them with AWS Key Management Service (AWS KMS) and enabling automatic rotation of secrets. The developer can create an RDS database secret in AWS Secrets Manager and set the user name, password, database, host, and port for accessing the RDS database. The developer can also turn on secret rotation, which will change the database credentials periodically according to a specified schedule or event. AWS Systems Manager Parameter Store is a service that provides secure and scalable storage for configuration data and secrets. The developer can create Secure String parameters in AWS Systems Manager Parameter Store for the DynamoDB table, S3 bucket, and SNS topic, which will encrypt them with AWS KMS. The developer can also reuse the parameter values from other applications and update them without modifying code.
Option A is not optimal because it will create encrypted Lambda environment variables for the DynamoDB table, S3 bucket, and SNS topic, which may not be reusable or updatable without modifying code.
Option C is not optimal because it will create RDS database parameters in AWS Systems Manager Parameter Store, which does not support automatic rotation of secrets.
Option D is not optimal because it will store the DynamoDB table, S3 bucket, and SNS topic in Amazon S3, which may introduce additional costs and complexity for accessing configuration data.
Reference: AWS Secrets Manager, [AWS Systems Manager Parameter Store]
A developer is creating a new batch application that will run on an Amazon EC2 instance. The application requires read access to an Amazon S3 bucket. The developer needs to follow security best practices to grant S3 read access to the application.
Which solution meets these requirements?
- A . Add the permissions to an 1AM policy. Attach the policy to a role. Attach the role to the EC2 instance profile.
- B . Add the permissions inline to an 1AM group. Attach the group to the EC2 instance profile.
- C . Add the permissions to an 1AM policy. Attach the policy to a user. Attach the user to the EC2 instance profile.
- D . Add the permissions to an 1AM policy. Use 1AM web identity federation to access the S3 bucket with the policy.
A
Explanation:
Step 1: Understanding the Requirements
Best Practices for Security:
Minimize the use of hardcoded credentials or long-lived access keys.
Use IAM roles for EC2 instances to securely grant permissions to applications running on the instance.
Access Scope: The application needs read-only access to an S3 bucket.
Step 2: Solution Analysis
Option A:
Define an IAM policy with the required s3:GetObject permissions.
Attach this policy to an IAM role.
Assign the role to the EC2 instance profile.
This approach follows security best practices by eliminating the need for static credentials and using temporary, scoped credentials provided by the instance profile. Correct option.
Option B:
IAM groups are used for organizing users, not for EC2 instances or instance profiles.
Not suitable.
Option C:
IAM users are associated with specific individuals or applications and require static credentials.
This violates security best practices for temporary credentials and roles.
Not suitable.
Option D:
IAM web identity federation is used for applications that authenticate users via third-party identity providers.
This is unnecessary for EC2 instances and does not align with the requirements.
Not suitable.
Step 3: Implementation Steps
Create an IAM Policy:
Grant read-only access to the S3 bucket:
json
Copy code
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::your-bucket-name/*"
}
]
}
Attach the Policy to an IAM Role:
Create an IAM role and attach the policy to the role.
Associate the Role with the EC2 Instance:
Attach the role to the instance profile used by the EC2 instance.
AWS Developer
Reference: IAM Roles for Amazon EC2
Amazon S3 Permissions Reference
A company has an application that is hosted on Amazon EC2 instances The application stores objects in an Amazon S3 bucket and allows users to download objects from the S3 bucket A developer turns on S3 Block Public Access for the S3 bucket After this change, users report errors when they attempt to download objects The developer needs to implement a solution so that only users who are signed in to the application can access objects in the S3 bucket.
Which combination of steps will meet these requirements in the MOST secure way? (Select TWO.)
- A . Create an EC2 instance profile and role with an appropriate policy Associate the role with the EC2 instances
- B . Create an 1AM user with an appropriate policy. Store the access key ID and secret access key on the EC2 instances
- C . Modify the application to use the S3 GeneratePresignedUrl API call
- D . Modify the application to use the S3 GetObject API call and to return the object handle to the user
- E . Modify the application to delegate requests to the S3 bucket.
AC
Explanation:
IAM Roles for EC2 (A): The most secure way to provide AWS permissions from EC2.
Create a role with a policy allowing s3:GetObject on the specific bucket.
Attach the role to an instance profile and associate that profile with your instances.
Pre-signed URLs (C): Temporary, authenticated URLs for specific S3 actions.
Modify the app to use the AWS SDK to call GeneratePresignedUrl.
Embed these URLs when a user is properly logged in, allowing download access.
Reference: IAM Roles for EC2: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html
Generating Presigned
URLs: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.htm
A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application uses Amazon DynamoDB as its database. The company wants to ensure high performance for reads and writes.
Which solution will meet these requirements MOST cost-effectively?
- A . Configure auto-scaling for the DynamoDB table with a target utilization of 70%. Set the minimum and maximum capacity units based on the expected workload.
- B . Use DynamoDB on-demand capacity mode for the table. Specify a maximum throughput higher than the expected peak read and write capacity units.
- C . Use DynamoDB provisioned throughput mode for the table. Create an Amazon CloudWatch alarm on the ThrottledRequests metric. Invoke an AWS Lambda function to increase provisioned capacity.
- D . Create an Amazon DynamoDB Accelerator (DAX) cluster. Configure the application to use the DAX endpoint.
A
Explanation:
Why Option A is Correct:
Auto-scaling with a target utilization ensures the DynamoDB table dynamically adjusts capacity based on workload, maintaining high performance while optimizing cost. Setting a reasonable target utilization minimizes overprovisioning and throttling risks.
Why Other Options are Incorrect:
Option B: On-demand capacity is costlier than provisioned throughput for predictable workloads.
Option C: Using manual CloudWatch alarms and Lambda for scaling is less efficient and adds operational overhead.
Option D: DAX accelerates read performance but does not improve write performance.
AWS Documentation
Reference: DynamoDB Auto Scaling
A company needs to set up secure database credentials for all its AWS Cloud resources. The company’s resources include Amazon RDS DB instances Amazon DocumentDB clusters and Amazon Aurora DB instances. The company’s security policy mandates that database credentials be encrypted at rest and rotated at a regular interval.
Which solution will meet these requirements MOST securely?
- A . Set up IAM database authentication for token-based access. Generate user tokens to provide centralized access to RDS DB instances. Amazon DocumentDB clusters and Aurora DB instances.
- B . Create parameters for the database credentials in AWS Systems Manager Parameter Store Set the Type parameter to Secure Sting. Set up automatic rotation on the parameters.
- C . Store the database access credentials as an encrypted Amazon S3 object in an S3 bucket Block all public access on the S3 bucket. Use S3 server-side encryption to set up automatic rotation on the encryption key.
- D . Create an AWS Lambda function by using the SecretsManagerRotationTemplate template in the AWS Secrets Manager console. Create secrets for the database credentials in Secrets Manager Set up secrets rotation on a schedule.
D
Explanation:
This solution will meet the requirements by using AWS Secrets Manager, which is a service that helps protect secrets such as database credentials by encrypting them with AWS Key Management Service (AWS KMS) and enabling automatic rotation of secrets. The developer can create an AWS Lambda function by using the SecretsManagerRotationTemplate template in the AWS Secrets Manager console, which provides a sample code for rotating secrets for RDS DB instances, Amazon DocumentDB clusters, and Amazon Aurora DB instances. The developer can also create secrets for the database credentials in Secrets Manager, which encrypts them at rest and provides secure access to them. The developer can set up secrets rotation on a schedule, which changes the database credentials periodically according to a specified interval or event.
Option A is not optimal because it will set up IAM database authentication for token-based access, which may not be compatible with all database engines and may require additional configuration and management of IAM roles or users.
Option B is not optimal because it will create parameters for the database credentials in AWS Systems Manager Parameter Store, which does not support automatic rotation of secrets.
Option C is not optimal because it will store the database access credentials as an encrypted Amazon S3 object in an S3 bucket, which may introduce additional costs and complexity for accessing and securing the data.
Reference: [AWS Secrets Manager], [Rotating Your AWS Secrets Manager Secrets]
A company has an Amazon S3 bucket that contains sensitive data. The data must be encrypted in transit and at rest. The company encrypts the data in the S3 bucket by using an AWS Key Management Service (AWS KMS) key. A developer needs to grant several other AWS accounts the permission to use the S3 GetObject operation to retrieve the data from the S3 bucket.
How can the developer enforce that all requests to retrieve the data provide encryption in transit?
- A . Define a resource-based policy on the S3 bucket to deny access when a request meets the condition “aws:SecureTransport”: “false”.
- B . Define a resource-based policy on the S3 bucket to allow access when a request meets the condition “aws:SecureTransport”: “false”.
- C . Define a role-based policy on the other accounts’ roles to deny access when a request meets the condition of “aws:SecureTransport”: “false”.
- D . Define a resource-based policy on the KMS key to deny access when a request meets the condition of “aws:SecureTransport”: “false”.
A
Explanation:
Amazon S3 supports resource-based policies, which are JSON documents that specify the permissions for accessing S3 resources. A resource-based policy can be used to enforce encryption in transit by denying access to requests that do not use HTTPS. The condition key aws:SecureTransport can be used to check if the request was sent using SSL. If the value of this key is false, the request is denied; otherwise, the request is allowed.
Reference: How do I use an S3 bucket policy to require requests to use Secure Socket Layer (SSL)?