Amazon DVA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
A developer is building an application that gives users the ability to view bank account from multiple sources in a single dashboard. The developer has automated the process to retrieve API credentials for these sources. The process invokes an AWS Lambda function that is associated with an AWS CloudFormation cotton resource.
The developer wants a solution that will store the API credentials with minimal operational overhead.
When solution will meet these requirements?
- A . Add an AWS Secrets Manager GenerateSecretString resource to the CloudFormation template. Set the value to reference new credentials to the Cloudformation resource.
- B . Use the AWS SDK ssm PutParameter operation in the Lambda function from the existing, custom resource to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set ma parameter type to SecureString.
- C . Add an AWS Systems Manager Parameter Store resource to the CloudFormation template. Set the CloudFormation resource value to reference the new credentials Set the resource NoEcho attribute to true.
- D . Use the AWS SDK ssm PutParameter operation in the Lambda function from the existing custom resources to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set the parameter NoEcho attribute to true.
B
Explanation:
The solution that will meet the requirements is to use the AWS SDK ssm PutParameter operation in the Lambda function from the existing custom resource to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set the parameter type to SecureString. This way, the developer can store the API credentials with minimal operational overhead, as AWS Systems Manager Parameter Store provides secure and scalable storage for configuration data. The SecureString parameter type encrypts the parameter value with AWS Key Management Service (AWS KMS). The other options either involve adding additional resources to the CloudFormation template, which increases complexity and cost, or do not encrypt the parameter value, which reduces security.
Reference: Creating Systems Manager parameters
A company has an application that uses an Amazon S3 bucket for object storage. A developer needs to configure in-transit encryption for the S3 bucket. All the S3 objects containing personal data needs to be encrypted at rest with AWS KMS keys, which can be rotated on demand.
Which combination of steps will meet these requirements? (Select TWO.)
- A . Write an S3 bucket policy to allow only encrypted connections over HTTPS by using permissions boundary.
- B . Configure an S3 bucket policy to enable client-side encryption for the objects containing personal data by using an AWS KMS customer managed key
- C . Configure the application to encrypt the objects by using an AWS KMS customer managed key before uploading the objects containing personal data to Amazon S3.
- D . Write an S3 bucket policy to allow only encrypted connections over HTTPS by using the aws:SecureTransport condition.
- E . Configure S3 Block Public Access settings for the S3 bucket to allow only encrypted connections over HTTPS.
CD
Explanation:
Step-by-Step Breakdown:
Requirement Summary:
In-transit encryption (when data is moving between client and S3)
Encryption at rest using AWS KMS keys (which are rotatable on-demand)
Option A: Write an S3 bucket policy to allow only encrypted connections over HTTPS by using permissions boundary
❌ Incorrect: Permissions boundaries are for IAM policy control, not S3 bucket policies. Also, encryption enforcement in-transit is not achieved through permissions boundaries.
Option B: Configure an S3 bucket policy to enable client-side encryption
❌ Incorrect: AWS does not enforce client-side encryption via S3 bucket policies.
Client-side encryption must be handled entirely by the application.
Also, KMS is for server-side encryption, not client-side.
Option C: Configure the application to encrypt the objects by using an AWS KMS customer managed key before uploading the objects
✅ Correct: This fulfills the requirement of encrypting objects at rest using a KMS CMK, which can be rotated.
You can specify the KMS key using the SSE-KMS option when putting an object.
Option D: Write an S3 bucket policy to allow only encrypted connections over HTTPS by using the aws:SecureTransport condition
✅ Correct: This enforces in-transit encryption, which ensures that only HTTPS connections are
allowed.
This is the AWS-recommended way to enforce encryption in transit via bucket policy.
Option E: Configure S3 Block Public Access settings for the S3 bucket to allow only encrypted connections over HTTPS
❌ Incorrect: Block Public Access is used to prevent public exposure of the bucket. It has nothing to do with encryption enforcement, whether in transit or at rest.
Using SSE-KMS:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html
aws:SecureTransport condition in bucket policies:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html
Server-side encryption with AWS KMS:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv-side-encryption.html
A social media application is experiencing high volumes of new user requests after a recent marketing campaign. The application is served by an Amazon RDS for MySQL instance. A solutions architect examines the database performance and notices high CPU usage and many "too many connections" errors that lead to failed requests on the database. The solutions architect needs to address the failed requests.
Which solution will meet this requirement?
- A . Deploy an Amazon DynamoDB Accelerator (DAX) cluster. Configure the application to use the DAX cluster.
- B . Deploy an RDS Proxy. Configure the application to use the RDS Proxy.
- C . Migrate the database to an Amazon RDS for PostgreSQL instance.
- D . Deploy an Amazon ElastiCache (Redis OSS) cluster. Configure the application to use the ElastiCache cluster.
B
Explanation:
Why Option B is Correct:
RDS Proxy manages database connections efficiently, reducing overhead on the RDS instance and mitigating "too many connections" errors.
Why Other Options are Incorrect:
Option A: DAX is for DynamoDB, not RDS.
Option C: Migration to PostgreSQL does not address the current issue.
Option D: ElastiCache is useful for caching but does not solve connection pool issues.
AWS Documentation
Reference: Amazon RDS Proxy
A developer is migrating some features from a legacy monolithic application to use AWS Lambda functions instead. The application currently stores data in an Amazon Aurora DB cluster that runs in private subnets in a VPC. The AWS account has one VPC deployed. The Lambda functions and the DB cluster are deployed in the same AWS Region in the same AWS account.
The developer needs to ensure that the Lambda functions can securely access the DB cluster without crossing the public internet.
Which solution will meet these requirements?
- A . Configure the DB cluster’s public access setting to Yes.
- B . Configure an Amazon RDS database proxy for the Lambda functions.
- C . Configure a NAT gateway and a security group for the Lambda functions.
- D . Configure the VPC, subnets, and a security group for the Lambda functions.
D
Explanation:
This solution will meet the requirements by allowing the Lambda functions to access the DB cluster securely within the same VPC without crossing the public internet. The developer can configure a VPC endpoint for RDS in a private subnet and assign it to the Lambda functions. The developer can also configure a security group for the Lambda functions that allows inbound traffic from the DB cluster on port 3306 (MySQL).
Option A is not optimal because it will expose the DB cluster to public access, which may compromise its security and data integrity.
Option B is not optimal because it will introduce additional latency and complexity to use an RDS database proxy for accessing the DB cluster from Lambda functions within the same VPC.
Option C is not optimal because it will require additional costs and configuration to use a NAT gateway for accessing resources in private subnets from Lambda functions.
Reference: [Configuring a Lambda Function to Access Resources in a VPC]
A developer is creating an application that will give users the ability to store photos from their cellphones in the cloud. The application needs to support tens of thousands of users. The application uses an Amazon API Gateway REST API that is integrated with AWS Lambda functions to process the photos. The application stores details about the photos in Amazon DynamoDB.
Users need to create an account to access the application. In the application, users must be able to upload photos and retrieve previously uploaded photos. The photos will range in size from 300 KB to 5 MB.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Use Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use the Lambda function to store the photos and details in the DynamoDB table. Retrieve previously uploaded photos directly from the DynamoDB table.
- B . Use Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use the Lambda function to store the photos in Amazon S3. Store the object’s S3 key as part of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
- C . Create an IAM user for each user of the application during the sign-up process. Use IAM authentication to access the API Gateway API. Use the Lambda function to store the photos in Amazon S3. Store the object’s S3 key as part of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
- D . Create a users table in DynamoDB. Use the table to manage user accounts. Create a Lambda authorizer that validates user credentials against the users table. Integrate the Lambda authorizer with API Gateway to control access to the API. Use the Lambda function to store the photos in Amazon S3. Store the object’s S3 key as par of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
B
Explanation:
Amazon Cognito user pools is a service that provides a secure user directory that scales to hundreds of millions of users. The developer can use Amazon Cognito user pools to manage user accounts and create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. The developer can use the Lambda function to store the photos in Amazon S3, which is a highly scalable, durable, and secure object storage service. The developer can store the object’s S3 key as part of the photo details in the DynamoDB table, which is a fast and flexible NoSQL database service. The developer can retrieve previously uploaded photos by querying DynamoDB for the S3 key and fetching the photos from S3. This solution will meet the requirements with the least operational overhead.
Reference: [Amazon Cognito User Pools]
[Use Amazon Cognito User Pools – Amazon API Gateway] [Amazon Simple Storage Service (S3)] [Amazon DynamoDB]
An Amazon Kinesis Data Firehose delivery stream is receiving customer data that contains personally identifiable information. A developer needs to remove pattern-based customer identifiers from the data and store the modified data in an Amazon S3 bucket.
What should the developer do to meet these requirements?
- A . Implement Kinesis Data Firehose data transformation as an AWS Lambda function. Configure the function to remove the customer identifiers. Set an Amazon S3 bucket as the destination of the delivery stream.
- B . Launch an Amazon EC2 instance. Set the EC2 instance as the destination of the delivery stream. Run an application on the EC2 instance to remove the customer identifiers. Store the transformed data in an Amazon S3 bucket.
- C . Create an Amazon OpenSearch Service instance. Set the OpenSearch Service instance as the destination of the delivery stream. Use search and replace to remove the customer identifiers. Export the data to an Amazon S3 bucket.
- D . Create an AWS Step Functions workflow to remove the customer identifiers. As the last step in the workflow, store the transformed data in an Amazon S3 bucket. Set the workflow as the destination of the delivery stream.
A
Explanation:
Amazon Kinesis Data Firehose is a service that delivers real-time streaming data to destinations such as Amazon S3, Amazon Redshift, Amazon OpenSearch Service, and Amazon Kinesis Data Analytics. The developer can implement Kinesis Data Firehose data transformation as an AWS Lambda function. The function can remove pattern-based customer identifiers from the data and return the
modified data to Kinesis Data Firehose. The developer can set an Amazon S3 bucket as the
destination of the delivery stream.
Reference: [What Is Amazon Kinesis Data Firehose? – Amazon Kinesis Data Firehose] [Data Transformation – Amazon Kinesis Data Firehose]
A company wants to use AWS AppConfig to gradually deploy a new feature to 15% of users to test the feature before a full deployment.
Which solution will meet this requirement with the LEAST operational overhead?
- A . Set up a custom script within the application to randomly select 15% of users. Assign a flag for the new feature to the selected users.
- B . Create separate AWS AppConfig feature flags for both groups of users. Configure the flags to target 15% of users.
- C . Create an AWS AppConfig feature flag. Define a variant for the new feature, and create a rule to target 15% of users.
- D . Use AWS AppConfig to create a feature flag without variants. Implement a custom traffic splitting mechanism in the application code.
C
Explanation:
Comprehensive Detailed and Lengthy Step-by-Step Explanation with All AWS Developer
Reference: 1. Understanding the Use Case:
The company wants to gradually release a new feature to 15% of users to perform testing. AWS AppConfig is designed to manage and deploy configurations, including feature flags, allowing controlled rollouts.
A developer wants the ability to roll back to a previous version of an AWS Lambda function in the event of errors caused by a new deployment.
How can the developer achieve this with MINIMAL impact on users?
- A . Change the application to use an alias that points to the current version. Deploy the new version of the code Update the alias to use the newly deployed version. If too many errors are encountered, point the alias back to the previous version.
- B . Change the application to use an alias that points to the current version. Deploy the new version of the code. Update the alias to direct 10% of users to the newly deployed version. If too many errors are encountered, send 100% of traffic to the previous version
- C . Do not make any changes to the application. Deploy the new version of the code. If too many errors are encountered, point the application back to the previous version using the version number in the Amazon Resource Name (ARN).
- D . Create three aliases: new, existing, and router. Point the existing alias to the current version. Have the router alias direct 100% of users to the existing alias. Update the application to use the router alias. Deploy the new version of the code. Point the new alias to this version. Update the router alias to direct 10% of users to the new alias. If too many errors are encountered, send 100% of traffic to the existing alias.
A developer has created an AWS Lambda function that is written in Python. The Lambda function reads data from objects in Amazon S3 and writes data to an Amazon DynamoDB table. The function is successfully invoked from an S3 event notification when an object is created. However, the function fails when it attempts to write to the DynamoDB table.
What is the MOST likely cause of this issue?
- A . The Lambda function’s concurrency limit has been exceeded.
- B . DynamoDB table requires a global secondary index (GSI) to support writes.
- C . The Lambda function does not have IAM permissions to write to DynamoDB.
- D . The DynamoDB table is not running in the same Availability Zone as the Lambda function.
C
Explanation:
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_lambda-access-dynamodb.html
A developer is creating a mobile app that calls a backend service by using an Amazon API Gateway REST API. For integration testing during the development phase, the developer wants to simulate different backend responses without invoking the backend service.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Create an AWS Lambda function. Use API Gateway proxy integration to return constant HTTP responses.
- B . Create an Amazon EC2 instance that serves the backend REST API by using an AWS CloudFormation template.
- C . Customize the API Gateway stage to select a response type based on the request.
- D . Use a request mapping template to select the mock integration response.
D
Explanation:
Amazon API Gateway supports mock integration responses, which are predefined responses that can be returned without sending requests to a backend service. Mock integration responses can be used for testing or prototyping purposes, or for simulating different backend responses based on certain conditions. A request mapping template can be used to select a mock integration response based on an expression that evaluates some aspects of the request, such as headers, query strings, or body content. This solution does not require any additional resources or code changes and has the least operational overhead.
Reference: Set up mock integrations for an API Gateway REST API
https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-mock-integration.html