AWS DVA-C02: Developer Associate Practice Exam

What the AWS DVA-C02 exam covers

• Development with AWS Services231 questions
• Security132 questions
• Deployment127 questions
• Troubleshooting and Optimization172 questions

Free AWS DVA-C02 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 662.

1. Question 1Development with AWS Services

   Which AWS service runs event-driven code without provisioning or managing servers?

   • AAmazon RDS
   • BAWS LambdaCorrect
   • CAmazon EC2
   • DAmazon VPC
   ✓ Correct answer: B

   AWS Lambda is the correct choice because it directly addresses the scenario's requirements. This option provides the functionality and characteristics described in the question. Understanding the capabilities and use cases of AWS services is essential for designing solutions that meet specific business and technical requirements. When evaluating options, consider which service is purpose-built for the scenario and whether it integrates well with other components of your architecture.

   Why the other options are wrong

   • AAmazon RDS is incorrect because this option does not provide the correct functionality for the described scenario.
   • CAmazon EC2 is incorrect because this option does not provide the correct functionality for the described scenario.
   • DAmazon VPC is incorrect because this option does not provide the correct functionality for the described scenario.
2. Question 2Security

   An S3 object should be temporarily shared with someone who has no AWS credentials. What's the recommended mechanism?

   • AA pre-signed URL with a limited expirationCorrect
   • BSharing your access keys
   • CMaking the whole bucket public
   • DDisabling bucket encryption
   ✓ Correct answer: A

   A pre-signed URL with a limited expiration is the correct choice because it directly addresses the scenario's requirements. This option provides the functionality and characteristics described in the question. Understanding the capabilities and use cases of AWS services is essential for designing solutions that meet specific business and technical requirements. When evaluating options, consider which service is purpose-built for the scenario and whether it integrates well with other components of your architecture.

   Why the other options are wrong

   • BSharing your access keys is incorrect because this option does not provide the correct functionality for the described scenario.
   • CMaking the whole bucket public is incorrect because this approach sacrifices security; the correct option maintains security while meeting the requirements.
   • DDisabling bucket encryption is incorrect because removing or disabling disabling does not align with best practices for this scenario.
3. Question 3Deployment

   A SAM template defines a Lambda with AutoPublishAlias and a CodeDeploy canary deployment. During deployment, CloudWatch alarms breach. What happens?

   • ATraffic shifting simply pauses at the current weight and waits indefinitely for a human to take manual action
   • BThe Lambda function and its alias are deleted, and the team must recreate the whole function by hand afterward
   • CCodeDeploy automatically rolls back by shifting traffic back to the previous version, because the deployment is associated with rollback-triggering alarmsCorrect
   • DThe deployment ignores the breaching alarms and continues shifting traffic all the way to 100 percent of the new version
   ✓ Correct answer: C

   CodeDeploy automatically rolls back by shifting traffic back to the previous version, because the deployment is associated with rollback-triggering alarms is the correct choice because it directly addresses the scenario's requirements. This option provides the functionality and characteristics described in the question. Understanding the capabilities and use cases of AWS services is essential for designing solutions that meet specific business and technical requirements. When evaluating options, consider which service is purpose-built for the scenario and whether it integrates well with other components of your architecture.

   Why the other options are wrong

   • AAn alarm breach triggers an automatic rollback rather than an indefinite pause at the current weight.
   • BRollback shifts traffic back to the prior version; it does not delete the function.
   • DAssociated alarms do affect Lambda traffic shifting and stop the rollout, so it does not proceed to 100%.
4. Question 4Troubleshooting and Optimization

   A REST API Gateway endpoint shows a high 5XXError CloudWatch metric, but 4XXError is low. What does this most likely indicate?

   • ARequests are being throttled at the usage-plan rate limit
   • BRequests are missing a required API key on the endpoint
   • CServer-side failures in the backend integration (e.g., Lambda errors or timeouts)Correct
   • DClients are sending malformed request payloads to the API
   ✓ Correct answer: C

   5XX errors (5XXError metric) indicate problems on the server side: the backend integration (Lambda, HTTP endpoint, etc.) is returning errors or timing out. API Gateway is successfully receiving the request but the integration is failing. 4XX errors indicate client-side problems (bad requests, auth failures, etc.). High 5XX with low 4XX points to backend failures.

   Why the other options are wrong

   • AThrottling produces 429 responses counted under 4XXError, not the 5XXError metric.
   • BA missing API key returns a 403, which is a client-side 4XX error.
   • DMalformed requests are client errors that surface as 4XX, not 5XX server errors.
5. Question 5Troubleshooting and Optimization

   An async-invoked Lambda occasionally fails, and the team sees the same event retried automatically but cannot find where permanently failed events go. By default, how does Lambda handle repeated async failures, and what should be added to capture them?

   • ALambda retries the async event indefinitely, so no separate capture mechanism is needed
   • BLambda retries an async invocation twice then discards the event; add an on-failure destination or DLQ to capture failed eventsCorrect
   • CLambda writes each failed async event to an S3 bucket in the account automatically
   • DLambda queues failed async events in the function's provisioned concurrency pool for replay
   ✓ Correct answer: B

   When Lambda is invoked asynchronously (e.g., from S3 events, SNS, or direct async calls), it automatically retries a failed invocation up to two additional times (three total attempts) with delays between retries. After all retries are exhausted, the event is discarded unless a failure destination (SQS queue, SNS topic, EventBridge, or another Lambda) or a Dead Letter Queue (DLQ) is configured on the function. Without one of these, permanently failed events are silently lost.

   Why the other options are wrong

   • ALambda does not retry async invocations indefinitely; after two retries the event is discarded unless a destination is set.
   • CLambda does not automatically write failed async events to S3; capture requires an on-failure destination or DLQ.
   • DProvisioned concurrency pre-warms execution environments and does not store or replay failed events.
6. Question 6Security

   A developer wants to grant an IAM role the ability to read from a specific Secrets Manager secret but explicitly deny the ability to delete it. They write a policy with both an Allow for secretsmanager:GetSecretValue and an explicit Deny for secretsmanager:DeleteSecret on the same resource ARN. What is the effective permission?

   • AThe explicit Deny is ignored when the Allow is on the same resource, so both actions are allowed
   • BThe Allow for GetSecretValue is active; the explicit Deny for DeleteSecret prevents deletion regardless of any other policyCorrect
   • CHaving both Allow and Deny on the same resource causes a policy evaluation error
   • DThe last statement in the policy document wins, so the outcome depends on statement order
   ✓ Correct answer: B

   AWS IAM policy evaluation follows the explicit-deny-wins rule: an explicit Deny in any applicable policy always overrides an explicit Allow, regardless of which policy or statement contains it. In this case, GetSecretValue has only an Allow (no Deny), so it is permitted. DeleteSecret has an explicit Deny, so it is blocked regardless of any Allow that might exist in any other attached policy.

   Why the other options are wrong

   • AAWS IAM never ignores an explicit Deny on the same resource; an explicit Deny always takes precedence over an Allow.
   • CAWS IAM policy evaluation handles Allow and Deny statements on the same resource without error; explicit Deny simply wins.
   • DIAM policy evaluation is not order-dependent; all statements are evaluated together and explicit Deny wins regardless of position in the document.
7. Question 7Troubleshooting and Optimization

   A developer needs to determine the p99 duration of Lambda invocations over the past 24 hours using CloudWatch. Which approach produces a p99 statistic?

   • AUse a CloudWatch GetMetricStatistics API call requesting the Average statistic for the Duration metric
   • BUse a CloudWatch GetMetricStatistics API call requesting the p99 extended statistic for the Duration metricCorrect
   • CRun a CloudWatch Logs Insights query computing AVG(duration) across all log events
   • DReview the Lambda Monitoring tab's maximum duration graph
   ✓ Correct answer: B

   CloudWatch supports percentile extended statistics (p10, p50, p90, p99, p99.9, etc.) for applicable metrics including Lambda Duration. By calling GetMetricStatistics (or using GetMetricData) with the ExtendedStatistics parameter set to 'p99', you retrieve the 99th percentile latency, which is the threshold below which 99% of invocations complete. This is more meaningful than average for identifying tail latency and SLA compliance.

   Why the other options are wrong

   • AThe Average statistic returns the mean duration, which hides outliers and tail latency. A p99 requires the extended statistic parameter, not the standard Average.
   • CCloudWatch Logs Insights AVG(duration) computes the average of a parsed numeric field from log text. This requires the logs to contain a parseable duration field and produces mean, not percentile, values without additional query logic.
   • DThe Lambda Monitoring tab's maximum duration graph shows the single highest duration within each period. Maximum is even more sensitive to outliers than p99 and does not represent the 99th percentile.
8. Question 8Development with AWS Services

   A developer needs to share common libraries and a custom runtime across several Lambda functions without bundling the dependencies into each deployment package. Which Lambda feature should they use?

   • ALambda layersCorrect
   • BLambda extensions
   • CContainer image packaging
   • DLambda destinations
   ✓ Correct answer: A

   A layer is a .zip archive containing libraries, a custom runtime, or other dependencies that multiple functions can reference. This keeps deployment packages small and centralizes shared code, exactly matching the requirement.

   Why the other options are wrong

   • BExtensions augment the function's lifecycle for monitoring/security agents; they are not the mechanism for sharing application libraries.
   • CContainer images bundle everything into one image, which is the opposite of sharing dependencies separately across functions.
   • DDestinations route invocation results to other services; they are unrelated to sharing code.
9. Question 9Security

   A developer needs to allow code in an AWS CodeBuild project to access an S3 artifact bucket without embedding credentials. What is the correct mechanism?

   • AAssign an IAM service role to the CodeBuild projectCorrect
   • BReference an IAM user's access key from a Secrets Manager environment variable in the buildspec
   • CAdd the developer's IAM user credentials as encrypted CodeBuild environment variables
   • DConfigure a VPC endpoint to S3 so no credentials are required
   ✓ Correct answer: A

   A CodeBuild project assumes its configured service role, and the AWS SDK/CLI in the build environment automatically retrieves temporary credentials for that role. Scoping the role's permissions to the artifact bucket grants access without storing any long-lived keys.

   Why the other options are wrong

   • BPulling an IAM user's access key from Secrets Manager still relies on long-lived user credentials for the build; a service role provides temporary credentials without any stored keys.
   • CEncrypting a developer's credentials as environment variables still embeds long-lived user keys tied to a person, rather than using the project's own service role.
   • DA VPC endpoint controls the network path to S3 but does not authenticate the caller; the build still needs credentials, which the service role supplies.
10. Question 10Deployment

    A team manages a CloudFormation stack and wants to protect a production database from accidental deletion if someone deletes the stack. Which mechanism stops the stack itself from being deleted until it is explicitly disabled?

    • AEnabling termination protection on the stackCorrect
    • BSetting DeletionPolicy: Delete on the database
    • CAdding a DependsOn attribute
    • DSetting UpdateReplacePolicy: Snapshot
    ✓ Correct answer: A

    Stack-level termination protection prevents the DeleteStack operation from succeeding while enabled, requiring an explicit administrative action to disable it before deletion. This guards an entire stack, including a production database, from accidental teardown.

    Why the other options are wrong

    • BDeletionPolicy: Delete actually allows the resource to be removed, the opposite of protection.
    • CDependsOn only orders resource creation/deletion and does not prevent stack deletion.
    • DUpdateReplacePolicy: Snapshot governs behavior during replacement on update, not protection against stack deletion.

Related AWS resources

• AWS DVA-C02 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS CLF-C02 practice examRelated

AWS DVA-C02 practice exam FAQ