Amazon DVA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A developer is storing sensitive data generated by an application in Amazon S3. The developer wants to encrypt the data at rest. A company policy requires an audit trail of when the AWS Key Management Service (AWS KMS) key was used and by whom.
Which encryption option will meet these requirements?
- A . Server-side encryption with Amazon S3 managed keys (SSE-S3)
- B . Server-side encryption with AWS KMS managed keys (SSE-KMS}
- C . Server-side encryption with customer-provided keys (SSE-C)
- D . Server-side encryption with self-managed keys
B
Explanation:
This solution meets the requirements because it encrypts data at rest using AWS KMS keys and provides an audit trail of when and by whom they were used. Server-side encryption with AWS KMS managed keys (SSE-KMS) is a feature of Amazon S3 that encrypts data using keys that are managed by AWS KMS. When SSE-KMS is enabled for an S3 bucket or object, S3 requests AWS KMS to generate data keys and encrypts data using these keys. AWS KMS logs every use of its keys in AWS CloudTrail, which records all API calls to AWS KMS as events. These events include information such as who made the request, when it was made, and which key was used. The company policy can use CloudTrail logs to audit critical events related to their data encryption and access. Server-side encryption with Amazon S3 managed keys (SSE-S3) also encrypts data at rest using keys that are managed by S3, but does not provide an audit trail of key usage. Server-side encryption with customer-provided keys (SSE-C) and server-side encryption with self-managed keys also encrypt data at rest using keys that are provided or managed by customers, but do not provide an audit trail of key usage and require additional overhead for key management.
Reference: [Protecting Data Using Server-Side Encryption with AWS KMSCManaged Encryption Keys (SSE-KMS)], [Logging AWS KMS API calls with AWS CloudTrail]
A developer is writing unit tests tor a new application that will be deployed on AWS. The developer wants to validate all pull requests with unit tests and merge the code with the main branch only when all tests pass
The developer stores the code in AWS CodeCommit and sets up AWS CodeBuild to run the unit tests. The developer creates an AWS Lambda function to start the CodeBuild task. The developer needs to identify the CodeCommit events in an Amazon EventBridge event that can invoke the Lambda function when a pull request is created or updated.
Which CodeCommit event will meet these requirements?
- A . Option A
- B . Option B
- C . Option C
- D . Option D
C
Explanation:
https://aws.amazon.com/blogs/devops/automated-code-review-on-pull-requests-using-aws-codecommit-and-aws-codebuild/
A developer is creating an ecommerce workflow in an AWS Step Functions state machine that includes a HTTP Task state. The task passes shipping information and order details to an endpoint. The developer needs to test the workflow to confirm that the HTTP headers and body are correct and that the responses meet expectations.
- A . Use the TestState API to invoke only the HTTP Task. Set the inspection level to TRACE.
- B . Use the TestState API to invoke the state machine. Set the inspection level to DEBUG.
- C . Use the data flow simulator to invoke only the HTTP Task. View the request and response data.
- D . Change the log level of the state machine to ALL. Run the state machine.
A
Explanation:
Comprehensive and Detailed Step-by-Step
To confirm that the HTTP headers, body, and responses meet expectations, you need to test the specific HTTP Task state in isolation and inspect the details.
Option A: TestState API with TRACE:
The TestState API allows developers to test individual states in a state machine without executing the entire workflow.
Setting the inspection level to TRACE provides detailed information about the HTTP request and response, including headers, body, and status codes.
This option provides the precise and granular testing required to verify the HTTP Task functionality.
Why Other Options Are Incorrect:
Option B: The DEBUG inspection level provides less detailed information than TRACE and focuses on general debugging, not a detailed view of HTTP interactions.
Option C: Step Functions does not have a "data flow simulator" to test individual tasks; this option is not valid.
Option D: Changing the state machine’s log level to ALL increases logging granularity for the entire state machine but does not allow isolated testing of a specific HTTP Task.
Reference: AWS Step Functions: Testing State Machines
A developer maintains a critical business application that uses Amazon DynamoDB as the primary data store The DynamoDB table contains millions of documents and receives 30-60 requests each minute. The developer needs to perform processing in near-real time on the documents when they are added or updated in the DynamoDB table
How can the developer implement this feature with the LEAST amount of change to the existing application code?
- A . Set up a cron job on an Amazon EC2 instance Run a script every hour to query the table for changes and process the documents
- B . Enable a DynamoDB stream on the table Invoke an AWS Lambda function to process the documents.
- C . Update the application to send a PutEvents request to Amazon EventBridge. Create an EventBridge rule to invoke an AWS Lambda function to process the documents.
- D . Update the application to synchronously process the documents directly after the DynamoDB write
B
Explanation:
DynamoDB Streams: Capture near real-time changes to DynamoDB tables, triggering downstream actions.
Lambda for Processing: Lambda functions provide a serverless way to execute code in response to events like DynamoDB Stream updates.
Minimal Code Changes: This solution requires the least modifications to the existing application.
Reference: DynamoDB
Streams: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Streams.html
AWS Lambda: https://aws.amazon.com/lambda/
A developer needs to deploy an application running on AWS Fargate using Amazon ECS The application has environment variables that must be passed to a container for the application to initialize.
How should the environment variables be passed to the container?
- A . Define an array that includes the environment variables under the environment parameter within the service definition.
- B . Define an array that includes the environment variables under the environment parameter within the task definition.
- C . Define an array that includes the environment variables under the entryPoint parameter within the task definition.
- D . Define an array that includes the environment variables under the entryPoint parameter within the service definition.
B
Explanation:
This solution allows the environment variables to be passed to the container when it is launched by AWS Fargate using Amazon ECS. The task definition is a text file that describes one or more containers that form an application. It contains various parameters for configuring the containers, such as CPU and memory requirements, network mode, and environment variables. The environment parameter is an array of key-value pairs that specify environment variables to pass to a container. Defining an array that includes the environment variables under the entryPoint parameter within the task definition will not pass them to the container, but use them as command-line arguments for overriding the default entry point of a container. Defining an array that includes the environment variables under the environment or entryPoint parameter within the service definition will not pass them to the container, but cause an error because these parameters are not valid for a service definition.
Reference: [Task Definition Parameters], [Environment Variables]
A company is planning to use AWS CodeDeploy to deploy an application to Amazon Elastic Container Service (Amazon ECS) During the deployment of a new version of the application, the company initially must expose only 10% of live traffic to the new version of the deployed application. Then, after 15 minutes elapse, the company must route all the remaining live traffic to the new version of the deployed application.
Which CodeDeploy predefined configuration will meet these requirements?
- A . CodeDeployDefault ECSCanary10Percent15Minutes
- B . CodeDeployDefault LambdaCanary10Percent5Minutes
- C . CodeDeployDefault LambdaCanary10Percent15Minutes
- D . CodeDeployDefault ECSLinear10PercentEvery1 Minutes
A
Explanation:
CodeDeploy Predefined Configurations: CodeDeploy offers built-in deployment configurations for common scenarios.
Canary Deployment: Canary deployments gradually shift traffic to a new version, ideal for controlled rollouts like this requirement.
CodeDeployDefault.ECSCanary10Percent15Minutes: This configuration matches the company’s requirements, shifting 10% of traffic initially and then completing the rollout after 15 minutes.
Reference: AWS CodeDeploy Deployment
Configurations: https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-configurations-create.html
A developer needs to give a new application the ability to retrieve configuration data.
The application must be able to retrieve new configuration data values without the need to redeploy the application code. If the application becomes unhealthy because of a bad configuration change, the developer must be able to automatically revert the configuration change to the previous value.
- A . Use AWS Secrets Manager to manage and store the configuration data. Integrate Secrets Manager
with a custom AWS Config rule that has remediation actions to track changes in the application and to roll back any bad configuration changes. - B . Use AWS Secrets Manager to manage and store the configuration data. Integrate Secrets Manager with a custom AWS Config rule. Attach a custom AWS Systems Manager document to the rule that automatically rolls back any bad configuration changes.
- C . Use AWS AppConfig to manage and store the configuration data. Integrate AWS AppConfig with Amazon CloudWatch to monitor changes to the application. Set up an alarm to automatically roll back any bad configuration changes.
- D . Use AWS AppConfig to manage and store the configuration data. Integrate AWS AppConfig with Amazon CloudWatch to monitor changes to the application. Set up CloudWatch Application Signals to roll back any bad configuration changes.
D
Explanation:
Comprehensive and Detailed Step-by-Step
Option D: AWS AppConfig with CloudWatch Application Signals
AWS AppConfig is designed for managing and deploying application configurations dynamically, without redeployment.
CloudWatch Application Signals provide automatic rollback mechanisms in case of an unhealthy application state due to bad configuration changes.
This solution meets the requirements with minimal operational overhead by ensuring both dynamic
updates and rollback functionality.
Why Other Options Are Incorrect:
Option A and B: AWS Secrets Manager is designed for secrets management, not dynamic application configuration. Custom Config rules add unnecessary complexity.
Option C: While CloudWatch alarms can monitor application changes, using alarms for rollback requires manual setup and lacks the automatic rollback provided by Application Signals.
Reference: AWS AppConfig Documentation
A developer is creating an application that uses an Amazon DynamoDB table. The developer needs to develop code that reads all records that were added to the table during the previous day. creates HTML reports, and pushes the reports into third-party storage. The item size varies from 1 KB to 4 KB, and the index structure is defined with the date. The developer needs to minimize the read capacity that the application requires from the DynamoDB table.
Which DynamoDB API operation should the developer use in the code to meet these requirements?
- A . Query
- B . Scan
- C . BatchGetltem
- D . Getltem
An application stores user data in Amazon S3 buckets in multiple AWS Regions. A developer needs to implement a solution that analyzes the user data in the S3 buckets to find sensitive information. The analysis findings from all the S3 buckets must be available in the eu-west-2 Region.
Which solution will meet these requirements with the LEAST development effort?
- A . Create an AWS Lambda function to generate findings. Program the Lambda function to send the findings to another S3 bucket in eu-west-2.
- B . Configure Amazon Made to generate findings. Use Amazon EventBridge to create rules that copy the findings to eu-west-2.
- C . Configure Amazon Inspector to generate findings. Use Amazon EventBridge to create rules that copy the findings to eu-west-2.
- D . Configure Amazon Macie to generate findings and to publish the findings to AWS CloudTrail. Use a CloudTrail trail to copy the results to eu-west-2.
A company has developed an application that uses AWS Lambda functions to process messages from an Amazon SQS queue. One of the Lambda functions makes a call to an external API that is expected to encounter temporary service unavailability.
A developer needs to configure the function to retry failed messages from an Amazon SQS dead-letter queue. The developer notices that the Lambda function is re-processing some messages in the queue more than once.
Which solution will resolve this issue?
- A . Set a message retention period for each message. Configure the Lambda function to add a MessageId to each message.
- B . Set the visibility timeout parameter at the queue level. Configure the Lambda function to delete processed messages from the queue.
- C . Set a receive message wait time for each message. Configure the Lambda function to add a MessageId to each message.
- D . Set the delivery delay parameter at the queue level. Configure the Lambda function to delete processed messages from the queue.
B
Explanation:
Why Option B is Correct:
Setting the visibility timeout ensures that once a message is being processed, it is temporarily hidden from other consumers. The Lambda function must delete processed messages to avoid re-processing when the visibility timeout expires.
Why Other Options are Incorrect:
Option A: Message retention affects how long messages stay in the queue, not how they are processed.
Option C: Receive message wait time optimizes long polling but does not prevent re-processing.
Option D: Delivery delay introduces latency for new messages and does not address message re-processing.
AWS Documentation
Reference: Using SQS Visibility Timeout