Amazon DVA-C02 Practice Exams
Last updated on Oct 22,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 22,2026
A developer is creating a simple proof-of-concept demo by using AWS CloudFormation and AWS Lambda functions. The demo will use a CloudFormation template to deploy an existing Lambda function The Lambda function uses deployment packages and dependencies stored in Amazon S3 The developer defined an AWS Lambda Function resource in a CloudFormation template. The developer needs to add the S3 bucket to the CloudFormation template.
What should the developer do to meet these requirements with the LEAST development effort?
- A . Add the function code in the CloudFormation template inline as the code property
- B . Add the function code in the CloudFormation template as the ZipFile property.
- C . Find the S3 key for the Lambda function Add the S3 key as the ZipFile property in the CloudFormation template.
- D . Add the relevant key and bucket to the S3Bucket and S3Key properties in the CloudFormation template
D
Explanation:
S3Bucket and S3Key: These properties in a CloudFormation AWS::Lambda::Function resource specify the location of the function’s code in S3.
Least Development Effort: This solution minimizes code changes, relying on CloudFormation to
reference the existing S3 deployment package.
Reference: AWS::Lambda::Function
Resource https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html
A developer is using an AWS account to build an application that stores files in an Amazon S3 bucket. Files must be encrypted at rest by AWS KMS keys. A second AWS account must have access to read files from the bucket.
The developer wants to minimize operational overhead for the application.
Which combination of solutions will meet these requirements? (Select TWO.)
- A . Use a customer managed key to encrypt the files. Create a key policy that grants kms: Decrypt permissions to the second AWS account.
- B . Use an AWS managed key to encrypt the files. Create a key policy that grants kms:Decrypt permissions to the second AWS account.
- C . Create a service control policy (SCP) that grants s3:GetObject permissions to the second AWS account.
- D . Create a bucket policy for the S3 bucket that grants s3:GetObject permissions to the second AWS account.
- E . Create a gateway endpoint for the S3 bucket. Modify the endpoint policy to grant s3:GetObject permissions to the second AWS account.
A, D
Explanation:
Step-by-Step Breakdown:
Requirement Summary:
Encrypt S3 objects using KMS keys
Cross-account read access to another AWS account
Minimize operational overhead
Option A: Use a customer managed key + key policy granting kms:Decrypt to second account
✅ Correct: Customer managed keys allow full control of key policy.
You can add a statement to allow cross-account access using the second account’s IAM principal.
Option B: Use AWS managed key + key policy granting access to second account
❌ Incorrect: AWS-managed KMS keys (aws/s3) cannot be modified to add cross-account access in key policies.
Option C: SCP that grants s3:GetObject to second account
❌ Incorrect: SCPs are used to restrict or allow permissions across AWS Organizations, not to grant S3 or KMS access directly.
Option D: Create a bucket policy granting s3:GetObject to second account
✅ Correct: Bucket policies can grant cross-account access to specific IAM users or roles in the second account.
Option E: Gateway endpoint for S3 with cross-account access
❌ Incorrect: Gateway endpoints only apply within the same VPC/account. Cross-account use with endpoint policies is not the correct pattern for this use case.
Cross-account S3 access with KMS:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-
access-example2.html
KMS cross-account key policy: https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying.html
Bucket Policy for cross-account access:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html
A company has a social media application that receives large amounts of traffic User posts and interactions are continuously updated in an Amazon RDS database The data changes frequently, and the data types can be complex. The application must serve read requests with minimal latency
The application’s current architecture struggles to deliver these rapid data updates efficiently. The company needs a solution to improve the application’s performance.
Which solution will meet these requirements?
- A . Use Amazon DynamoDB Accelerator (DAX) in front of the RDS database to provide a caching layer for the high volume of rapidly changing data
- B . Set up Amazon S3 Transfer Acceleration on the RDS database to enhance the speed of data transfer from the databases to the application.
- C . Add an Amazon CloudFront distribution in front of the RDS database to provide a caching layer for the high volume of rapidly changing data
- D . Create an Amazon ElastiCache for Redis cluster. Update the application code to use a write-through caching strategy and read the data from Redis.
D
Explanation:
Amazon ElastiCache for Redis: An in-memory data store known for extremely low latency, ideal for caching frequently accessed, complex data.
Write-Through Caching: Ensures that data is always consistent between the cache and the database.
Writes go to both Redis and RDS.
Performance Gains: Redis handles reads with minimal latency, offloading the RDS database and improving the application’s responsiveness.
Reference: Amazon ElastiCache for Redis
Documentation: https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/
Caching Strategies: https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Strategies.html
An ecommerce application is running behind an Application Load Balancer. A developer observes some unexpected load on the application during non-peak hours. The developer wants to analyze patterns for the client IP addresses that use the application.
Which HTTP header should the developer use for this analysis?
- A . The X-Forwarded-Proto header
- B . The X-F Forwarded-Host header
- C . The X-Forwarded-For header
- D . The X-Forwarded-Port header
C
Explanation:
The HTTP header that the developer should use for this analysis is the X-Forwarded-For header. This header contains the IP address of the client that made the request to the Application Load Balancer. The developer can use this header to analyze patterns for the client IP addresses that use the application. The other headers either contain information about the protocol, host, or port of the request, which are not relevant for the analysis.
Reference: How Application Load Balancer works with your applications
A developer is designing an AWS Lambda function that creates temporary files that are less than 10 MB during invocation. The temporary files will be accessed and modified multiple times during invocation. The developer has no need to save or retrieve these files in the future.
Where should the temporary files be stored?
- A . the /tmp directory
- B . Amazon Elastic File System (Amazon EFS)
- C . Amazon Elastic Block Store (Amazon EBS)
- D . Amazon S3
A
Explanation:
AWS Lambda is a service that lets developers run code without provisioning or managing servers. Lambda provides a local file system that can be used to store temporary files during invocation. The local file system is mounted under the /tmp directory and has a limit of 512 MB. The temporary files are accessible only by the Lambda function that created them and are deleted after the function execution ends. The developer can store temporary files that are less than 10 MB in the /tmp directory and access and modify them multiple times during invocation.
Reference: [What Is AWS Lambda? – AWS Lambda]
[AWS Lambda Execution Environment – AWS Lambda]
A company requires that all applications running on Amazon EC2 use 1AM roles to gam access to AWS services. A developer is modifying an application that currently relies on 1AM user access keys stored in environment variables to access Amazon DynamoDB tables using boto, the AWS SDK for Python.
The developer associated a role with the same permissions as the 1AM user to the EC2 instance, then deleted the 1AM user. When the application was restarted, the AWS Access Denied Exception messages started appearing in the application logs. The developer was able to use their personal account on the server to run DynamoDB API commands using the AWS CLI.
What is the MOST likely cause of the exception?
- A . 1AM policies might take a few minutes to propagate to resources.
- B . Disabled environment variable credentials are still being used by the application.
- C . The AWS SDK does not support credentials obtained using an instance role.
- D . The instance’s security group does not allow access to http://169.254.169.254.
A social media company is designing a platform that allows users to upload data, which is stored in Amazon S3. Users can upload data encrypted with a public key. The company wants to ensure that only the company can decrypt the uploaded content using an asymmetric encryption key. The data must always be encrypted in transit and at rest.
- A . Use server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data.
- B . Use server-side encryption with customer-provided encryption keys (SSE-C) to encrypt the data.
- C . Use client-side encryption with a data key to encrypt the data.
- D . Use client-side encryption with a customer-managed encryption key to encrypt the data.
D
Explanation:
Step 1: Problem Understanding
Asymmetric Encryption Requirement: Users encrypt data with a public key, and only the company can decrypt it using a private key.
Data Encryption at Rest and In Transit: The data must be encrypted during upload (in transit) and
when stored in Amazon S3 (at rest).
Step 2: Solution Analysis
Option A: Server-side encryption with Amazon S3 managed keys (SSE-S3).
Amazon S3 manages the encryption and decryption keys.
This does not meet the requirement for asymmetric encryption, where the company uses a private key.
Not suitable.
Option B: Server-side encryption with customer-provided keys (SSE-C).
Requires the user to supply encryption keys during the upload process.
Does not align with the asymmetric encryption requirement.
Not suitable.
Option C: Client-side encryption with a data key.
Data key encryption is symmetric, not asymmetric.
Does not satisfy the requirement for a public-private key pair.
Not suitable.
Option D: Client-side encryption with a customer-managed encryption key.
Data is encrypted on the client side using the public key.
Only the company can decrypt the data using the corresponding private key.
Data remains encrypted during upload (in transit) and in S3 (at rest).
Correct option.
Step 3: Implementation Steps for Option D
Generate Key Pair:
The company generates an RSA key pair (public/private) for encryption and decryption.
Encrypt Data on Client Side:
Use the public key to encrypt the data before uploading to S3.
S3 Upload:
Upload the encrypted data to S3 over an HTTPS connection.
Decrypt Data on the Server:
Use the private key to decrypt data when needed.
AWS Developer
Reference: Amazon S3 Encryption Options
Asymmetric Key Cryptography in AWS
A developer is migrating an application to Amazon Elastic Kubernetes Service (Amazon EKS). The developer migrates the application to Amazon Elastic Container Registry (Amazon ECR) with an EKS cluster.
As part of the application migration to a new backend, the developer creates a new AWS account. The developer makes configuration changes to the application to point the application to the new AWS account and to use new backend resources. The developer successfully tests the changes within the application by deploying the pipeline.
The Docker image build and the pipeline deployment are successful, but the application is still connecting to the old backend. The developer finds that the application’s configuration is still referencing the original EKS cluster and not referencing the new backend resources.
Which reason can explain why the application is not connecting to the new resources?
- A . The developer did not successfully create the new AWS account.
- B . The developer added a new tag to the Docker image.
- C . The developer did not update the Docker image tag to a new version.
- D . The developer pushed the changes to a new Docker image tag.
C
Explanation:
The correct answer is C. The developer did not update the Docker image tag to a new version.
C. The developer did not update the Docker image tag to a new version. This is correct. When deploying an application to Amazon EKS, the developer needs to specify the Docker image tag that contains the application code and configuration. If the developer does not update the Docker image tag to a new version after making changes to the application, the EKS cluster will continue to use the old Docker image tag that references the original backend resources. To fix this issue, the developer should update the Docker image tag to a new version and redeploy the application to the EKS cluster. A. The developer did not successfully create the new AWS account. This is incorrect. The creation of a new AWS account is not related to the application’s connection to the backend resources. The developer can use any AWS account to host the EKS cluster and the backend resources, as long as they have the proper permissions and configurations.
B. The developer added a new tag to the Docker image. This is incorrect. Adding a new tag to the Docker image is not enough to deploy the changes to the application. The developer also needs to update the Docker image tag in the EKS cluster configuration, so that the EKS cluster can pull and run the new Docker image.
D. The developer pushed the changes to a new Docker image tag. This is incorrect. Pushing the changes to a new Docker image tag is not enough to deploy the changes to the application. The developer also needs to update the Docker image tag in the EKS cluster configuration, so that the EKS cluster can pull and run the new Docker image.
Reference: 1: Amazon EKS User Guide, “Deploying applications to your Amazon EKS cluster”, https://docs.aws.amazon.com/eks/latest/userguide/deploying-applications.html 2: Amazon ECR User Guide, “Pushing an image”, https://docs.aws.amazon.com/AmazonECR/latest/userguide/docker-push-ecr-image.html 3: Amazon EKS User Guide, “Updating an Amazon EKS cluster”, https://docs.aws.amazon.com/eks/latest/userguide/update-cluster.html
A developer is creating an Amazon DynamoDB table by using the AWS CLI The DynamoDB table must use server-side encryption with an AWS owned encryption key
How should the developer create the DynamoDB table to meet these requirements?
- A . Create an AWS Key Management Service (AWS KMS) customer managed key. Provide the key’s Amazon Resource Name (ARN) in the KMSMasterKeyld parameter during creation of the DynamoDB table
- B . Create an AWS Key Management Service (AWS KMS) AWS managed key Provide the key’s Amazon Resource Name (ARN) in the KMSMasterKeyld parameter during creation of the DynamoDB table
- C . Create an AWS owned key Provide the key’s Amazon Resource Name (ARN) in the KMSMasterKeyld parameter during creation of the DynamoDB table.
- D . Create the DynamoDB table with the default encryption options
D
Explanation:
Default SSE in DynamoDB: DynamoDB tables are encrypted at rest by default using an AWS owned key (SSE-S3).
No Additional Action Needed: Creating a table without explicitly specifying a KMS key will use this
default encryption.
Reference: DynamoDB Server-Side
Encryption: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Encryption
A developer is deploying a new application to Amazon Elastic Container Service (Amazon ECS). The developer needs to securely store and retrieve different types of variables. These variables include authentication information for a remote API, the URL for the API, and credentials. The authentication information and API URL must be available to all current and future deployed versions of the application across development, testing, and production environments.
How should the developer retrieve the variables with the FEWEST application changes?
- A . Update the application to retrieve the variables from AWS Systems Manager Parameter Store. Use unique paths in Parameter Store for each variable in each environment. Store the credentials in AWS Secrets Manager in each environment.
- B . Update the application to retrieve the variables from AWS Key Management Service (AWS KMS).
Store the API URL and credentials as unique keys for each environment. - C . Update the application to retrieve the variables from an encrypted file that is stored with the application. Store the API URL and credentials in unique files for each environment.
- D . Update the application to retrieve the variables from each of the deployed environments. Define the authentication information and API URL in the ECS task definition as unique names during the deployment process.
A
Explanation:
AWS Systems Manager Parameter Store is a service that provides secure, hierarchical storage for configuration data management and secrets management. The developer can update the application to retrieve the variables from Parameter Store by using the AWS SDK or the AWS CLI. The developer can use unique paths in Parameter Store for each variable in each environment, such as /dev/api-url,/test/api-url, and /prod/api-url. The developer can also store the credentials in AWS Secrets Manager, which is integrated with Parameter Store and provides additional features such as automatic rotation and encryption.
Reference: [What Is AWS Systems Manager? – AWS Systems Manager] [Parameter Store – AWS Systems Manager]
[What Is AWS Secrets Manager? – AWS Secrets Manager]