AWS DVA-C02: Developer Associate Practice Exam

What the AWS DVA-C02 exam covers

• Development with AWS Services240 questions
• Security137 questions
• Deployment132 questions
• Troubleshooting and Optimization178 questions

Free AWS DVA-C02 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 687.

1. Question 1Development with AWS Services

   Which AWS service runs event-driven code without provisioning or managing servers?

   • AAmazon RDS
   • BAWS LambdaCorrect
   • CAmazon EC2
   • DAmazon VPC
   ✓ Correct answer: B

   AWS Lambda is the correct choice because it directly addresses the scenario's requirements. This option provides the functionality and characteristics described in the question. Understanding the capabilities and use cases of AWS services is essential for designing solutions that meet specific business and technical requirements. When evaluating options, consider which service is purpose-built for the scenario and whether it integrates well with other components of your architecture.

   Why the other options are wrong

   • AAmazon RDS is incorrect because this option does not provide the correct functionality for the described scenario.
   • CAmazon EC2 is incorrect because this option does not provide the correct functionality for the described scenario.
   • DAmazon VPC is incorrect because this option does not provide the correct functionality for the described scenario.
2. Question 2Security

   What's the difference between an S3 bucket policy and an IAM policy for access control?

   • AThey are the same type of policy and behave identically in every case
   • BIAM policies apply only to the account root user, not to IAM users or roles
   • CA bucket policy is resource-based (attached to the bucket); an IAM policy is identity-basedCorrect
   • DA bucket policy encrypts objects while an IAM policy only controls console access
   ✓ Correct answer: C

   A bucket policy is resource-based (attached to the bucket); an IAM policy is identity-based (attached to a user/role) is the correct choice because it directly addresses the scenario's requirements. This option provides the functionality and characteristics described in the question. Understanding the capabilities and use cases of AWS services is essential for designing solutions that meet specific business and technical requirements. When evaluating options, consider which service is purpose-built for the scenario and whether it integrates well with other components of your architecture.

   Why the other options are wrong

   • AThey differ in where they attach: a bucket policy is resource-based and an IAM policy is identity-based.
   • BIAM policies attach to IAM users, groups, and roles, not solely to the root user.
   • DNeither policy encrypts data; both are authorization documents, and encryption is a separate S3 feature.
3. Question 3Deployment

   A developer wants the same CloudFormation template to behave differently in dev vs prod (e.g., instance sizes) without maintaining two templates. Which feature is intended for this?

   • AOutputs, which are what decide which resources get created in each environment
   • BUsing an entirely separate AWS account is the only way to vary values per environment
   • CHard-code two copies of every resource and comment out the unused set per environment
   • DParameters combined with Mappings and Conditions to select values/resources per environmentCorrect
   ✓ Correct answer: D

   parameters combined with Mappings and Conditions to select values/resources per environment is the correct choice because it directly addresses the scenario's requirements. This option provides the functionality and characteristics described in the question. Understanding the capabilities and use cases of AWS services is essential for designing solutions that meet specific business and technical requirements. When evaluating options, consider which service is purpose-built for the scenario and whether it integrates well with other components of your architecture.

   Why the other options are wrong

   • AOutputs export values from a stack; they do not control which resources a template creates.
   • BSeparate accounts can isolate environments but are not required to vary values in one template.
   • CDuplicating and commenting out resources is unmaintainable and defeats a single reusable template.
4. Question 4Troubleshooting and Optimization

   A nightly automation job invokes a Lambda function asynchronously, but occasional failures are silently lost. How can the developer capture failed asynchronous invocations for later inspection?

   • AAttach an Application Load Balancer in front of the function to catch the failed invocations
   • BIncrease the function's allocated memory so the occasional failing invocations complete instead
   • CEnable S3 Transfer Acceleration for the workload so failed events are retried more quickly
   • DConfigure a Lambda destination (or DLQ) for asynchronous invocation failures pointing to an SQS queue or SNS topicCorrect
   ✓ Correct answer: D

   When Lambda processes an asynchronous invocation and all retry attempts are exhausted, the event is discarded by default with no record of the failure. By configuring an on-failure destination or a dead-letter queue (DLQ), the developer ensures that failed event payloads are sent to an SQS queue or SNS topic for later inspection, replay, or alerting. Lambda destinations are the newer, more flexible mechanism that can capture both success and failure outcomes with richer metadata including error details and stack traces. This approach provides durable capture of failed events without modifying the function code.

   Why the other options are wrong

   • AAn ALB routes synchronous HTTP requests and does not capture failed asynchronous invocations.
   • BMore memory speeds execution but does not preserve events that failed after all async retries.
   • CTransfer Acceleration speeds S3 uploads and is unrelated to capturing failed Lambda invocations.
5. Question 5Security

   When two policies apply to the same request and one statement explicitly denies an action while another explicitly allows it, what is the result?

   • AThe request is allowed only if the principal is the root user
   • BThe most recently created policy wins
   • CThe request is denied, because an explicit Deny always overrides any AllowCorrect
   • DThe request is allowed, because Allow always wins
   ✓ Correct answer: C

   AWS IAM evaluation logic follows a strict precedence order: an explicit Deny in any applicable policy always wins over any Allow, regardless of how many other policies grant the action. This prevents accidental or malicious privilege escalation through broad allow statements and is a foundational rule that applies across identity policies, resource policies, SCPs, and permissions boundaries.

   Why the other options are wrong

   • ARoot user status does not override the explicit Deny rule - even the root account is subject to SCPs, and normal explicit Deny logic still applies in policy evaluation.
   • BAllow never unconditionally wins - the explicit Deny override is a core AWS policy evaluation rule that applies in all scenarios.
   • DAWS IAM has no concept of policy creation order determining outcome - all applicable policies are evaluated simultaneously using the deny-overrides-allow logic.
6. Question 6SecuritySelect all that apply

   A developer must store a 6 KB configuration blob (JSON) containing non-sensitive settings AND a 256-byte database password securely in AWS Systems Manager. Select TWO statements that correctly describe the appropriate Parameter Store configurations. (Choose TWO)

   • AStore the JSON config blob as a String parameter type; standard tier parameters support values up to 8 KBCorrect
   • BStore the database password as a SecureString parameter type, which encrypts the value using KMSCorrect
   • CStore the database password as a String parameter type and encrypt it manually with KMS before storing
   • DStore the JSON config blob as a StringList parameter type to take advantage of automatic JSON schema validation
   ✓ Correct answer: A, B

   AWS Systems Manager Parameter Store offers String, StringList, and SecureString types. A non-sensitive JSON configuration blob should be stored as a String parameter, and a sensitive value like a database password should be stored as a SecureString, which encrypts the value with a KMS key (AWS-managed or customer-managed) and integrates with IAM for access control. Important sizing detail: the Standard parameter tier limits a value to 4 KB (4,096 bytes), while the Advanced tier supports up to 8 KB. Because the JSON blob is 6 KB, it exceeds the Standard tier and must be stored using the Advanced tier; the 256-byte password fits in either tier. Options A and B describe the correct parameter types, though A's claim that Standard tier supports up to 8 KB is inaccurate - that 8 KB ceiling applies only to the Advanced tier.

   Why the other options are wrong

   • CManually encrypting with KMS and storing as a plain String is possible but bypasses the built-in SecureString encryption, forces you to manage encrypt/decrypt logic, and loses the integrated IAM and KMS access controls SecureString provides.
   • DStringList is a comma-delimited list of plain strings; it provides no JSON schema validation and would not faithfully represent or protect a complex JSON configuration blob.
7. Question 7Development with AWS Services

   A developer deploys a Lambda function and notices cold starts are adding over 2 seconds of latency for the first request after idle periods. The function serves interactive user traffic. Which feature most directly reduces this cold-start latency?

   • ALambda Provisioned ConcurrencyCorrect
   • BIncreasing the Lambda function's memory allocation
   • CEnabling Lambda SnapStart for Java
   • DReducing the deployment package size to under 1 MB
   ✓ Correct answer: A

   Provisioned Concurrency pre-initializes a specified number of Lambda execution environments so they are ready to respond immediately, eliminating cold-start latency for that capacity. This is the most direct solution regardless of runtime. It is suited for latency-sensitive workloads and can be configured as a fixed number or automatically scaled.

   Why the other options are wrong

   • BIncreasing memory speeds up initialization slightly because more CPU is also allocated, but it does not eliminate cold starts - provisioned concurrency does.
   • CLambda SnapStart is a feature specific to Java functions that caches a snapshot of the initialized execution environment - it is not applicable to all runtimes and is a different mechanism than provisioned concurrency.
   • DSmaller deployment packages reduce download time during initialization, but they do not eliminate the cold-start overhead caused by environment bootstrapping and runtime initialization.
8. Question 8Development with AWS ServicesSelect all that apply

   A developer is choosing how Amazon S3 should notify other services when objects are created. Which TWO destinations can receive S3 Event Notifications directly? (Choose TWO)

   • AAn AWS Lambda functionCorrect
   • BAn Amazon SQS queueCorrect
   • CAn EC2 instance
   • DAn Amazon RDS database via JDBC
   ✓ Correct answer: A, B

   S3 supports three native event notification destinations: Lambda functions, SQS queues, and SNS topics. An s3:ObjectCreated:* event can invoke a Lambda function or enqueue a message in SQS for downstream processing.

   Why the other options are wrong

   • CS3 cannot push events into an EC2 instance over SSH; there is no such notification target.
   • DRDS over JDBC is not a supported S3 event notification destination; you would route through Lambda or a queue instead.
9. Question 9Security

   A Lambda function must decrypt data using a KMS key, but the key resides in another AWS account. Besides granting kms:Decrypt in the function's IAM policy, what else is required?

   • AThe KMS key policy in the other account must grant the function's role permission to use the keyCorrect
   • BThe function must be deployed in the same VPC as the KMS key
   • CThe function's environment variables must contain the key's plaintext material
   • DThe function must enable provisioned concurrency
   ✓ Correct answer: A

   KMS access requires both an identity-based grant in the caller's account and an allow in the key's resource policy (or a grant). For cross-account access, the key policy must explicitly permit the external principal/role, otherwise the request is denied even with kms:Decrypt in the IAM policy.

   Why the other options are wrong

   • BKMS is a regional service reached over its API; VPC co-location is not required.
   • CKMS keys are never exported as plaintext into environment variables.
   • DProvisioned concurrency affects cold starts, not KMS authorization.
10. Question 10Troubleshooting and Optimization

    An application using the AWS SDK with the default retry behavior is hammering a throttled service, making throttling worse. Which client configuration best mitigates this?

    • ADisable retries entirely
    • BEnable exponential backoff with jitter (e.g., the adaptive retry mode)Correct
    • CIncrease the number of immediate fixed-interval retries to 50
    • DOpen more concurrent connections to spread the load
    ✓ Correct answer: B

    Exponential backoff progressively increases the wait between retries, and jitter randomizes timing so many clients do not retry in lockstep. AWS SDK adaptive retry mode adds client-side rate limiting on top, reducing pressure on a throttled service.

    Why the other options are wrong

    • ADisabling retries removes resilience to transient throttling and can cause unnecessary request failures.
    • CMany immediate fixed-interval retries amplify the retry storm and worsen throttling.
    • DOpening more concurrent connections increases load and makes the throttling problem worse.

Who this AWS DVA-C02 practice exam is for

This practice set is for anyone preparing for the AWS DVA-C02: Developer Associate exam at the intermediate level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS DVA-C02 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS DVA-C02 exam.

Related AWS resources

• AWS DVA-C02 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Best AWS SAA-C03 Practice Exams (2026)Comparison
• AWS SAA-C03 vs DVA-C02Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS MLA-C02 practice examRelated
• AWS SAA-C03 practice examRelated
• AWS SAP-C02 practice examRelated

AWS DVA-C02 practice exam FAQ