Amazon DVA-C02 Practice Exams
Last updated on Oct 21,2026- Exam Code: DVA-C02
- Exam Name: AWS Certified Developer - Associate
- Certification Provider: Amazon
- Latest update: Oct 21,2026
A company wants to share information with a third party. The third party has an HTTP API endpoint that the company can use to share the information. The company has the required API key to access the HTTP API.
The company needs a way to manage the API key by using code. The integration of the API key with the application code cannot affect application performance.
Which solution will meet these requirements MOST securely?
- A . Store the API credentials in AWS Secrets Manager. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.
- B . Store the API credentials in a local code variable. Push the code to a secure Git repository. Use the local code variable at runtime to make the API call.
- C . Store the API credentials as an object in a private Amazon S3 bucket. Restrict access to the S3 object by using IAM policies. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.
- D . Store the API credentials in an Amazon DynamoDB table. Restrict access to the table by using resource-based policies. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.
A
Explanation:
AWS Secrets Manager is a service that helps securely store, rotate, and manage secrets such as API keys, passwords, and tokens. The developer can store the API credentials in AWS Secrets Manager and retrieve them at runtime by using the AWS SDK. This solution will meet the requirements of security, code management, and performance. Storing the API credentials in a local code variable or an S3 object is not secure, as it exposes the credentials to unauthorized access or leakage. Storing the API credentials in a DynamoDB table is also not secure, as it requires additional encryption and access control measures. Moreover, retrieving the credentials from S3 or DynamoDB may affect application performance due to network latency.
Reference: [What Is AWS Secrets Manager? – AWS Secrets Manager] [Retrieving a Secret – AWS Secrets Manager]
A developer is building a microservices-based application by using Python on AWS and several AWS services The developer must use AWS X-Ray The developer views the service map by using the console to view the service dependencies. During testing, the developer notices that some services are missing from the service map
What can the developer do to ensure that all services appear in the X-Ray service map?
- A . Modify the X-Ray Python agent configuration in each service to increase the sampling rate
- B . Instrument the application by using the X-Ray SDK for Python. Install the X-Ray SDK for all the services that the application uses
- C . Enable X-Ray data aggregation in Amazon CloudWatch Logs for all the services that the application uses
- D . Increase the X-Ray service map timeout value in the X-Ray console
B
Explanation:
AWS X-Ray SDK: The primary way to enable X-Ray tracing within applications. The SDK sends data about requests and subsegments to the X-Ray daemon for service map generation. Instrumenting All Services: To visualize a complete microservice architecture on the service map, each relevant service must include the X-Ray SDK.
Reference: AWS X-Ray Documentation: https://docs.aws.amazon.com/xray/
X-Ray SDK for Python: https://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-python.html
A company has an AWS Step Functions state machine named myStateMachine. The company configured a service role for Step Functions. The developer must ensure that only the myStateMachine state machine can assume the service role.
Which statement should the developer add to the trust policy to meet this requirement?
- A . "Condition": { "ArnLike": { "aws:SourceArn":"urn:aws:states:ap-south-1:111111111111:stateMachine:myStateMachine" } }
- B . "Condition": { "ArnLike": { "aws:SourceArn":"arn:aws:states:ap-south-1:*:stateMachine:myStateMachine" } }
- C . "Condition": { "StringEquals": { "aws:SourceAccount": "111111111111" } }
- D . "Condition": { "StringNotEquals": { "aws:SourceArn":"arn:aws:states:ap-south-1:111111111111:stateMachine:myStateMachine" } }
A
Explanation:
Why Option A is Correct:
The ArnLike condition with the specific ARN for myStateMachine ensures that only this state machine can assume the role. The format urn:aws:states is correct for specifying Step Functions resources.
Why Other Options are Incorrect:
Option B: Wildcards (*) in the ARN allow more resources to assume the role, which violates the requirement.
Option C: This condition restricts the account but not the specific state machine.
Option D: A StringNotEquals condition is used to deny specific values, which does not ensure exclusivity for the desired state machine.
AWS Documentation
Reference: IAM Trust Policies for Step Functions
A developer is troubleshooting an application mat uses Amazon DynamoDB in the uswest-2 Region. The application is deployed to an Amazon EC2 instance. The application requires read-only permissions to a table that is named Cars. The EC2 instance has an attached IAM role that contains the following IAM policy.
When the application tries to read from the Cars table, an Access Denied error occurs.
How can the developer resolve this error?
- A . Modify the IAM policy resource to be "arn aws dynamo* us-west-2 account-id table/*"
- B . Modify the IAM policy to include the dynamodb * action
- C . Create a trust policy that specifies the EC2 service principal. Associate the role with the policy.
- D . Create a trust relationship between the role and dynamodb Amazonas com.
C
Explanation:
https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/access-control-overview.html#access-control-resource-ownership
A company created an application to consume and process data. The application uses Amazon SQS and AWS Lambda functions. The application is currently working as expected, but it occasionally receives several messages that it cannot process properly. The company needs to clear these messages to prevent the queue from becoming blocked. A developer must implement a solution that makes queue processing always operational. The solution must give the company the ability to defer the messages with errors and save these messages for further analysis.
What is the MOST operationally efficient solution that meets these requirements?
- A . Configure Amazon CloudWatch Logs to save the error messages to a separate log stream.
- B . Create a new SQS queue. Set the new queue as a dead-letter queue for the application queue.
Configure the Maximum Receives setting. - C . Change the SQS queue to a FIFO queue. Configure the message retention period to 0 seconds.
- D . Configure an Amazon CloudWatch alarm for Lambda function errors. Publish messages to an Amazon SNS topic to notify administrator users.
B
Explanation:
Using a dead-letter queue (DLQ) with Amazon SQS is the most operationally efficient solution for handling unprocessable messages.
Amazon SQS Dead-Letter Queue:
A DLQ is used to capture messages that fail processing after a specified number of attempts.
Allows the application to continue processing other messages without being blocked.
Messages in the DLQ can be analyzed later for debugging and resolution.
Why DLQ is the Best Option:
Operational Efficiency: Automatically defers messages with errors, ensuring the queue is not blocked.
Analysis Ready: Messages in the DLQ can be inspected to identify recurring issues.
Scalable: Works seamlessly with Lambda and SQS at scale.
Why Not Other Options:
Option A: Logs the messages but does not resolve the queue blockage issue.
Option C: FIFO queues and 0-second retention do not provide error handling or analysis capabilities.
Option D: Alerts administrators but does not handle or store the unprocessable messages.
Steps to Implement:
Create a new SQS queue to serve as the DLQ.
Attach the DLQ to the primary queue and configure the Maximum Receives setting.
Reference: Using Amazon SQS Dead-Letter Queues
Best Practices for Using Amazon SQS with AWS Lambda
A web application is using Amazon Kinesis Data Streams for clickstream data that may not be consumed for up to 12 hours.
How can the developer implement encryption at rest for data within the Kinesis Data Streams?
- A . Enable SSL connections to Kinesis.
- B . Use Amazon Kinesis Consumer Library.
- C . Encrypt the data once it is at rest with a Lambda function.
- D . Enable server-side encryption in Kinesis Data Streams.
A real-time messaging application uses Amazon API Gateway WebSocket APIs with backend HTTP service. A developer needs to build a feature in the application to identify a client that keeps connecting to and disconnecting from the WebSocket connection. The developer also needs the ability to remove the client
Which combination of changes should the developer make to the application to meet these requirements? (Select TWO.)
- A . Switch to HTTP APIs in the backend service.
- B . Switch to REST APIs in the backend service.
- C . Use the callback URL to disconnect the client from the backend service.
- D . Add code to track the client status in Amazon ElastiCache in the backend service.
- E . Implement $connect and $disconnect routes in the backend service.
D, E
Explanation:
Requirement Summary:
WebSocket-based messaging app using API Gateway WebSocket APIs
Need to:
Identify clients repeatedly connecting/disconnecting
Be able to remove problematic clients
Evaluate Options:
A developer wants to insert a record into an Amazon DynamoDB table as soon as a new file is added to an Amazon S3 bucket.
Which set of steps would be necessary to achieve this?
- A . Create an event with Amazon EventBridge that will monitor the S3 bucket and then insert the records into DynamoDB.
- B . Configure an S3 event to invoke an AWS Lambda function that inserts records into DynamoDB.
- C . Create an AWS Lambda function that will poll the S3 bucket and then insert the records into DynamoDB.
- D . Create a cron job that will run at a scheduled time and insert the records into DynamoDB.
B
Explanation:
Amazon S3 is a service that provides highly scalable, durable, and secure object storage. Amazon DynamoDB is a fully managed NoSQL database service that provides fast and consistent performance with seamless scalability. AWS Lambda is a service that lets developers run code without provisioning or managing servers. The developer can configure an S3 event to invoke a Lambda function that inserts records into DynamoDB whenever a new file is added to the S3 bucket. This solution will meet the requirement of inserting a record into DynamoDB as soon as a new file is added to S3.
Reference: [Amazon Simple Storage Service (S3)]
[Amazon DynamoDB]
[What Is AWS Lambda? – AWS Lambda]
[Using AWS Lambda with Amazon S3 – AWS Lambda]
A developer wants to add request validation to a production environment Amazon API Gateway API. The developer needs to test the changes before the API is deployed to the production environment. For the test, the developer will send test requests to the API through a testing tool.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Export the existing API to an OpenAPI file. Create a new API. Import the OpenAPI file. Modify the new API to add request validation. Perform the tests. Modify the existing API to add request validation. Deploy the existing API to production.
- B . Modify the existing API to add request validation. Deploy the updated API to a new API Gateway stage. Perform the tests. Deploy the updated API to the API Gateway production stage.
- C . Create a new API. Add the necessary resources and methods, including new request validation. Perform the tests. Modify the existing API to add request validation. Deploy the existing API to production.
- D . Clone the existing API. Modify the new API to add request validation. Perform the tests. Modify the existing API to add request validation. Deploy the existing API to production.
B
Explanation:
Amazon API Gateway allows you to create, deploy, and manage a RESTful API to expose backend HTTP endpoints, AWS Lambda functions, or other AWS services1. You can use API Gateway to perform basic validation of an API request before proceeding with the integration request1. When the validation fails, API Gateway immediately fails the request, returns a 400 error response to the caller, and publishes the validation results in CloudWatch Logs1.
To test changes before deploying to a production environment, you can modify the existing API to add request validation and deploy the updated API to a new API Gateway stage1. This allows you to perform tests without affecting the production environment. Once testing is complete and successful, you can then deploy the updated API to the API Gateway production stage1.
This approach has the least operational overhead as it avoids unnecessary creation of new APIs or exporting and importing of APIs. It leverages the existing infrastructure and only requires changes in the configuration of the existing API1.
A company is planning to deploy an application on AWS behind an Elastic Load Balancing (ELB) load balancer. The application uses an HTTP/HTTPS listener and must access the client IP addresses.
Which load-balancing solution meets these requirements?
- A . Use an Application Load Balancer and the X-Forwarded-For headers.
- B . Use a Network Load Balancer (NLB). Enable proxy protocol support on the NLB and the target application.
- C . Use an Application Load Balancer. Register the targets by the instance ID.
- D . Use a Network Load Balancer and the X-Forwarded-For headers.