Amazon DVA-C02 Practice Exams
Last updated on Oct 23,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 23,2026
A developer is building an application that uses an Amazon RDS for PostgreSQL database. To meet security requirements, the developer needs to ensure that data is encrypted at rest. The developer must be able to rotate the encryption keys on demand.
- A . Use an AWS KMS managed encryption key to encrypt the database.
- B . Create a symmetric customer managed AWS KMS key. Use the key to encrypt the database.
- C . Create a 256-bit AES-GCM encryption key. Store the key in AWS Secrets Manager, and enable managed rotation. Use the key to encrypt the database.
- D . Create a 256-bit AES-GCM encryption key. Store the key in AWS Secrets Manager. Configure an AWS Lambda function to perform key rotation. Use the key to encrypt the database.
B
Explanation:
Why Option B is Correct:
A customer-managed AWS Key Management Service (KMS) key allows for encryption at rest and provides the ability to rotate the key on demand. This ensures compliance with security requirements for key management and database encryption.
RDS integrates natively with AWS KMS, allowing the use of a customer-managed key for encrypting data at rest.
Key rotation can be managed directly in AWS KMS without needing custom solutions.
Why Other Options are Incorrect:
Option A: AWS KMS managed encryption keys (AWS-owned keys) do not support key rotation on demand.
Option C & D: Storing keys in AWS Secrets Manager with custom rotation is not a recommended approach for database encryption. AWS KMS is designed specifically for secure key management and encryption.
AWS Documentation
Reference: Encrypting Amazon RDS Resources
AWS Key Management Service (KMS)
A developer at a company needs to create a small application that makes the same API call once each day at a designated time. The company does not have infrastructure in the AWS Cloud yet, but the company wants to implement this functionality on AWS.
Which solution meets these requirements in the MOST operationally efficient manner?
- A . Use a Kubernetes cron job that runs on Amazon Elastic Kubernetes Service (Amazon EKS).
- B . Use an Amazon Linux crontab scheduled job that runs on Amazon EC2.
- C . Use an AWS Lambda function that is invoked by an Amazon EventBridge scheduled event.
- D . Use an AWS Batch job that is submitted to an AWS Batch job queue.
C
Explanation:
The correct answer is
C. Use an AWS Lambda function that is invoked by an Amazon EventBridge scheduled event.
C. Use an AWS Lambda function that is invoked by an Amazon EventBridge scheduled event. This is correct. AWS Lambda is a serverless compute service that lets you run code without provisioning or
managing servers. Lambda runs your code on a high-availability compute infrastructure and performs all of the administration of the compute resources, including server and operating system maintenance, capacity provisioning and automatic scaling, and logging1. Amazon EventBridge is a serverless event bus service that enables you to connect your applications with data from a variety of sources2. EventBridge can create rules that run on a schedule, either at regular intervals or at specific times and dates, and invoke targets such as Lambda functions3. This solution meets the requirements of creating a small application that makes the same API call once each day at a designated time, without requiring any infrastructure in the AWS Cloud or any operational overhead.
A company has a web application that contains an Amazon API Gateway REST API. A developer has created an AWS CloudFormation template for the initial deployment of the application. The developer has deployed the application successfully as part of an AWS CodePipeline continuous integration and continuous delivery (CI/CD) process. All resources and methods are available through the deployed stage endpoint.
The CloudFormation template contains the following resource types:
• AWS::ApiGateway::RestApi
• AWS::ApiGateway::Resource
• AWS::ApiGateway::Method
• AWS:ApiGateway::Stage
• AWS::ApiGateway:;Deployment
The developer adds a new resource to the REST API with additional methods and redeploys the template. CloudFormation reports that the deployment is successful and that the stack is in the UPDATE_COMPLETE state. However, calls to all new methods are returning 404 (Not Found) errors.
What should the developer do to make the new methods available?
- A . Specify the disable-rollback option during the update-stack operation.
- B . Unset the Cloud Forma lion stack failure options.
- C . Add an AWS CodeBuild stage lo CodePipeline to run the aws apigateway create-deployment AWS CLI command.
- D . Add an action to CodePipeline to run the aws cloudfront create-invalidation AWS CLI command.
A company caches session information for a web application in an Amazon DynamoDB table. The company wants an automated way to delete old items from the table.
What is the simplest way to do this?
- A . Write a script that deletes old records; schedule the script as a cron job on an Amazon EC2 instance.
- B . Add an attribute with the expiration time; enable the Time To Live feature based on that attribute.
- C . Each day, create a new table to hold session data; delete the previous day’s table.
- D . Add an attribute with the expiration time; name the attribute ItemExpiration.
A company has an application that is deployed on AWS Elastic Beanstalk. The application generates user-specific PDFs and stores the PDFs in an Amazon S3 bucket. The application then uses Amazon Simple Email Service (Amazon SES) to send the PDFs by email to subscribers.
Users no longer access the PDFs 90 days after the PDFs are generated. The S3 bucket is not versioned and contains many obsolete PDFs.
A developer must reduce the number of files in the S3 bucket by removing PDFs that are older than 90 days.
Which solution will meet this requirement with the LEAST development effort?
- A . Update the application code. In the code, add a rule to scan all the objects in the S3 bucket every day and to delete objects after 90 days.
- B . Create an AWS Lambda function. Program the Lambda function to scan all the objects in the S3 bucket every day and to delete objects after 90 days.
- C . Create an S3 Lifecycle rule for the S3 bucket to expire objects after 90 days.
- D . Partition the S3 objects with a <year>/<month>/<day> key prefix. Create an AWS Lambda function to remove objects that have prefixes that have reached the expiration date.
A developer uses AWS IAM Identity Center to interact with the AWS CLI and AWS SDKs on a local workstation. API calls to AWS services were working when the SSO access was first configured. However, the developer is now receiving Access Denied errors. The developer has not changed any configuration files or scripts that were previously working on the workstation.
What is the MOST likely cause of the developer’s access issue?
- A . The access permissions to the developer’s AWS CLI binary file have changed.
- B . The permission set that is assumed by IAM Identity Center does not have the necessary permissions to complete the API call.
- C . The credentials from the IAM Identity Center federated role have expired.
- D . The developer is attempting to make API calls to the incorrect AWS account.
C
Explanation:
Requirement Summary:
Developer uses AWS IAM Identity Center (SSO) with AWS CLI / SDKs
Initially working fine
Now receiving AccessDenied errors
No changes to config or scripts
Key Understanding:
IAM Identity Center credentials are temporary and time-limited. When you use SSO-based access via the AWS CLI (aws sso login), it obtains temporary credentials stored in the local cache. By default, these expire in 1 hour (can be extended).
Evaluate Options:
A developer wants to use an AWS AppSync API to invoke AWS Lambda functions to return dat
a. Some of the Lambda functions perform long-running processes. The AWS AppSync API needs to return responses immediately.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Configure the Lambda functions to be AWS AppSync data sources. Use Event mode for asynchronous Lambda invocation.
- B . Increase the timeout setting for the Lambda functions to accommodate longer processing times.
- C . Set up an Amazon SQS queue. Configure AWS AppSync to send messages to the SQS queue.
Configure a Lambda function event source mapping to poll the queue. - D . Enable caching, and increase the duration of the AWS AppSync cache TTL.
A
Explanation:
Step-by-Step Breakdown:
Requirement Summary:
AWS AppSync API needs to invoke Lambda functions
Some Lambda functions are long-running
AppSync should return immediately, minimizing operational overhead
**Option A: AppSync + Lambda as data source using Event Mode
✅ Correct: AWS AppSync supports asynchronous (event) invocation of Lambda data sources using Event Mode.
Event Mode means:
AppSync invokes Lambda asynchronously
Immediately returns a response to the client (typically a predefined payload or null) Ideal for fire-and-forget workloads or when the response is not immediately needed Option B: Increase Lambda timeout
❌ Incorrect: This keeps AppSync waiting.
Even with increased timeout, synchronous invocations would block AppSync responses.
Option C: SQS queue + polling Lambda
❌ Possible but too complex for this use case.
Requires additional infrastructure: queue + mapping + custom logic. Higher operational overhead compared to built-in AppSync Event Mode.
Option D: Enable caching in AppSync
❌ Irrelevant: AppSync cache is for optimizing repeated read queries, not for async workflows.
Asynchronous Lambda with AppSync:
https://docs.aws.amazon.com/appsync/latest/devguide/resolver-mapping-template-reference-
lambda.html#async-lambda-invocation
Lambda as AppSync Data Source: https://docs.aws.amazon.com/appsync/latest/devguide/tutorial-lambda-resolvers.html
Event Mode Docs: https://docs.aws.amazon.com/appsync/latest/devguide/lambda-resolvers.html#event-invocation-mode
A company uses Amazon DynamoDB as a data store for its order management system. The company frontend application stores orders in a DynamoDB table. The DynamoDB table is configured to send change events to a DynamoDB stream. The company uses an AWS Lambda function to log and process the incoming orders based on data from the DynamoDB stream.
An operational review reveals that the order quantity of incoming orders is sometimes set to 0. A developer needs to create a dashboard that will show how many unique customers this problem affects each day.
What should the developer do to implement the dashboard?
- A . Grant the Lambda function’s execution role permissions to upload logs to Amazon CloudWatch Logs. Implement a CloudWatch Logs Insights query that selects the number of unique customers for orders with order quantity equal to 0 and groups the results in 1-day periods. Add the CloudWatch Logs Insights query to a CloudWatch dashboard.
- B . Use Amazon Athena to query AWS CtoudTrail API logs for API calls. Implement an Athena query that selects the number of unique customers for orders with order quantity equal to 0 and groups the results in 1-day periods. Add the Athena query to an Amazon CloudWatch dashboard.
- C . Configure the Lambda function to send events to Amazon EventBridge. Create an EventBridge rule that groups the number of unique customers for orders with order quantity equal to 0 in 1-day periods. Add a CloudWatch dashboard as the target of the rule.
- D . Turn on custom Amazon CloudWatch metrics for the DynamoDB stream of the DynamoOB table. Create a CloudWatch alarm that groups the number of unique customers for orders with order quantity equal to 0 in 1-day periods. Add the CloudWatch alarm to a CloudWatch dashboard.
A developer is building a three-tier web application that should be able to handle a minimum of 5000 requests per minute. Requirements state that the web tier should be completely stateless while the application maintains session state for the users.
How can session data be externalized, keeping latency at the LOWEST possible value?
- A . Create an Amazon RDS instance, then implement session handling at the application level to leverage a database inside the RDS database instance for session data storage.
- B . Implement a shared file system solution across the underlying Amazon EC2 instances, then implement session handling at the application level to leverage the shared file system for session data storage.
- C . Create an Amazon ElastiCache (Memcached) cluster, then implement session handling at the application level to leverage the cluster for session data storage.
- D . Create an Amazon DynamoDB table, then implement session handling at the application level to leverage the table for session data storage.
C
Explanation:
Why Option C is Correct:
Amazon ElastiCache (Memcached) provides low-latency, in-memory caching suitable for session storage. It ensures stateless web tier operations and supports the high throughput of 5000 requests per minute.
Why Other Options are Incorrect:
Option A: RDS has higher latency compared to in-memory caching solutions like ElastiCache.
Option B: Shared file systems introduce additional complexity and are not ideal for low-latency session data storage.
Option D: DynamoDB has low latency but is less performant than ElastiCache for in-memory session management.
AWS Documentation
Reference: Amazon ElastiCache for Session State Management
A developer is optimizing an AWS Lambda function and wants to test the changes in production on a small percentage of all traffic. The Lambda function serves requests to a REST API in Amazon API Gateway. The developer needs to deploy their changes and perform a test in production without changing the API Gateway URL.
Which solution will meet these requirements?
- A . Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Publish the API to the canary stage.
- B . Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function.
Deploy a new API Gateway stage. - C . Define an alias on the $LATEST version of the Lambda function. Update the API Gateway endpoint to reference the new Lambda function alias. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the SLAT EST version of the Lambda function. Publish to the canary stage.
- D . Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Deploy the API to the production API Gateway stage.
C
Explanation:
A Lambda alias is a pointer to a specific Lambda function version or another alias1. A Lambda alias allows you to invoke different versions of a function using the same name1. You can also split traffic between two aliases by assigning weights to them1.
In this scenario, the developer needs to test their changes in production on a small percentage of all traffic without changing the API Gateway URL. To achieve this, the developer can follow these steps: Define an alias on the $LATEST version of the Lambda function. This will create a new alias that points to the latest code of the function.
Update the API Gateway endpoint to reference the new Lambda function alias. This will make the API Gateway invoke the alias instead of a specific version of the function.
Upload and publish the optimized Lambda function code. This will update the $LATEST version of the function with the new code.
On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. This will enable API Gateway to perform a canary deployment on a new API2. A canary deployment is a software development strategy in which a new version of an API is deployed for testing purposes, and the base version remains deployed as a production release for normal operations on the same stage2. The canary release receives a small percentage of API traffic and the production release takes up the rest2.
Update the API Gateway endpoint to use the $LATEST version of the Lambda function. This will make the canary release invoke the latest code of the function, which contains the optimized changes. Publish to the canary stage. This will deploy the changes to a subset of users for testing.
By using this solution, the developer can test their changes in production on a small percentage of all traffic without changing the API Gateway URL. The developer can also monitor and compare metrics between the canary and production releases, and promote or disable the canary as needed2.