AWS DVA-C03: Developer Associate Practice Exam

What the AWS DVA-C03 exam covers

• Development with AWS Services213 questions
• Security150 questions
• Testing and Deployment144 questions
• Troubleshooting and Optimization170 questions

Free AWS DVA-C03 practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 677-question bank.

1. Question 1Development with AWS Services

   Which AWS service runs event-driven code without provisioning or managing servers?

   • AAmazon RDS
   • BAWS LambdaCorrect
   • CAmazon EC2
   • DAmazon VPC
   ✓ Correct answer: B

   AWS Lambda runs code in response to events without any server for you to provision, patch, or scale. You upload a function, Lambda creates execution environments on demand, runs the handler per event, and bills only for the milliseconds of execution and the memory configured. Concurrency scales automatically with the incoming event rate.

   Why the other options are wrong

   • AAmazon RDS is a managed relational database; it runs no application code and is not an event-driven compute service.
   • CAmazon EC2 gives you virtual machines you must size, patch, and scale yourself, which is exactly the server management the question rules out.
   • DAmazon VPC is the network boundary in which resources run; it executes nothing.
2. Question 2Security

   Which service provides user sign-up/sign-in and federated identity for application end users?

   • AAWS CloudTrail
   • BAWS IAM (for AWS account principals)
   • CAmazon CognitoCorrect
   • DAmazon Inspector
   ✓ Correct answer: C

   Amazon Cognito user pools are the managed user directory for application end users: sign-up, sign-in, MFA, password policies, hosted UI, and federation with social and SAML or OIDC identity providers. It issues JWTs that an API can validate, which is distinct from IAM, whose principals are the identities that call AWS APIs.

   Why the other options are wrong

   • AAWS CloudTrail records API activity for auditing; it authenticates no one.
   • BIAM authenticates principals that call AWS APIs, and AWS does not recommend creating an IAM user per application end user.
   • DAmazon Inspector scans workloads for vulnerabilities and has no identity function.
3. Question 3Testing and Deployment

   You delete a CloudFormation stack, but one S3 bucket created by it remains. Why might a resource survive stack deletion?

   • AS3 buckets are global resources and are therefore always retained on stack deletion
   • BCloudFormation never deletes S3 buckets under any circumstances by design
   • CThe resource had a DeletionPolicy of Retain (or RetainExceptOnCreate)Correct
   • DThe stack was left in UPDATE_COMPLETE state, which blocks deletion of its resources
   ✓ Correct answer: C

   A DeletionPolicy of Retain on a resource tells CloudFormation to leave it in place when the stack is deleted, and RetainExceptOnCreate additionally keeps a resource that failed during its initial creation. Stateful resources such as buckets and databases are commonly given Retain so a stack deletion cannot destroy data; the resource simply becomes unmanaged.

   Why the other options are wrong

   • ABucket names are globally unique but buckets are regional resources and are deleted unless a DeletionPolicy retains them.
   • BCloudFormation does delete S3 buckets on stack deletion unless DeletionPolicy Retain is set.
   • DUPDATE_COMPLETE is a normal state and does not prevent CloudFormation from deleting managed resources.
4. Question 4Development with AWS Services

   After enabling DynamoDB Streams to integrate with a Lambda consumer, the developer notices records are being processed multiple times. What should the Lambda code do to handle this correctly?

   • ADisable DynamoDB Streams to stop duplicate records
   • BSwitch the table to provisioned capacity mode
   • CReduce the stream batch size to one to guarantee exactly-once delivery
   • DMake the processing logic idempotentCorrect
   ✓ Correct answer: D

   DynamoDB Streams and Lambda's event source mapping provide at-least-once delivery - the same record can be delivered more than once due to retries, failures, or Lambda's internal processing guarantees. The correct approach is to write idempotent processing logic, for example by tracking a processed record ID and skipping duplicates, so that reprocessing the same stream record produces the same end state as processing it once.

   Why the other options are wrong

   • ADisabling DynamoDB Streams removes the integration entirely and the function would no longer process any records, rather than solving the duplicate-processing problem.
   • BSwitching to provisioned capacity mode changes how DynamoDB handles read/write throughput and has no effect on stream delivery semantics or duplicate invocations.
   • CA batch size of one means each Lambda invocation processes a single record, but it does not prevent that record from being delivered again on retry; at-least-once delivery is a property of the stream, not the batch size.
5. Question 5Security

   A Cognito User Pool app must let users sign in with their corporate Microsoft Entra ID (SAML) accounts and receive Cognito tokens. How is this configured?

   • AAdd the SAML provider as an identity provider (IdP) in the user pool and configure federationCorrect
   • BCreate an IAM identity provider entry for the corporate SAML metadata in the account
   • CFederate through a Cognito Identity Pool and skip the user pool entirely
   • DValidate corporate SAML assertions in a Lambda trigger and mint tokens manually
   ✓ Correct answer: A

   Amazon Cognito User Pools support federation with external identity providers through SAML 2.0. By registering the Microsoft Entra ID tenant as a SAML identity provider in the user pool and configuring the federation settings (including the SAML metadata), users can authenticate with their corporate credentials and receive standard Cognito JWT tokens in return, enabling single sign-on without managing AWS-level user accounts.

   Why the other options are wrong

   • BAn IAM SAML identity provider federates into IAM roles, not into a Cognito user pool that issues Cognito tokens.
   • CIdentity Pools hand out temporary AWS credentials, not Cognito user pool tokens, so they do not satisfy the requirement.
   • DHand-rolling SAML validation in a Lambda ignores the built-in user pool SAML federation and reinvents secure token issuance.
6. Question 6Security

   A developer needs to allow an AWS Lambda function to be invoked by an SNS topic in a different AWS account. The Lambda function's resource-based policy must be updated. Which CLI command adds a cross-account permission to the Lambda function?

   • Aaws lambda add-permission --function-name MyFunction --statement-id sns-invoke --action lambda:InvokeFunction --principal sns.amazonaws.com --source-arn arn:aws:sns:us-east-1:123456789012:MyTopic --source-account 123456789012Correct
   • Baws lambda put-function-policy --function-name MyFunction --action lambda:InvokeFunction --principal sns.amazonaws.com --source-arn arn:aws:sns:us-east-1:123456789012:MyTopic --principal events.amazonaws.com --statement-id AllowEventBridgeInvoke --source-arn arn:aws:events:us-east-1:123456789012:rule/MyRule
   • Caws iam attach-role-policy --role-name MyFunctionRole --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaSNSInvokePolicy
   • Daws sns add-permission --topic-arn arn:aws:sns:us-east-1:123456789012:MyTopic --label sns-invoke --aws-account-id 123456789012 --action-name Subscribe
   ✓ Correct answer: A

   Lambda uses resource-based policies to grant services or accounts permission to invoke a function. The `aws lambda add-permission` command adds a statement to the function's resource-based policy. For cross-account SNS invocations, specifying --source-arn and --source-account together prevents confused-deputy attacks where any SNS topic in any account could invoke the function if only the principal (sns.amazonaws.com) is specified.

   Why the other options are wrong

   • BThere is no aws lambda put-function-policy command; resource-based permissions on a function are added with add-permission.
   • CAttaching an IAM policy to the function's role governs what the function can do, not who is allowed to invoke it cross-account.
   • Dsns add-permission edits the SNS topic policy, not the Lambda function's resource-based policy that authorizes the invocation.
7. Question 7Development with AWS Services

   A developer needs to return paginated results from an API Gateway + Lambda endpoint backed by DynamoDB. The DynamoDB scan returns a LastEvaluatedKey. How should the developer expose this to API clients for subsequent pages?

   • ABase64-encode the LastEvaluatedKey and return it as a nextToken the client passes backCorrect
   • BPersist the LastEvaluatedKey in a server-side DynamoDB item keyed by session and return only its short identifier to the client to request the next page
   • CEnable DynamoDB Streams on the table so the endpoint can automatically capture and deliver the subsequent pages of results to the client over time
   • DConfigure API Gateway response caching to store each LastEvaluatedKey and have the gateway automatically inject it into the client's next paginated request
   ✓ Correct answer: A

   DynamoDB pagination uses an exclusive start key: when a result is truncated, the response contains LastEvaluatedKey, which must be passed back as ExclusiveStartKey in the next request. The standard REST API pattern is to serialize this key (via Base64 or JSON encoding) into a nextToken or cursor field in the response body. The client passes this value in a subsequent request's query string, and Lambda decodes it and passes it to DynamoDB.

   Why the other options are wrong

   • BStoring the key server-side adds state and extra reads per page; passing an opaque token to the client is the standard stateless approach.
   • CDynamoDB Streams captures item change events for consumers, not pagination cursors for a query result set.
   • DAPI Gateway caching stores full responses by key and cannot track and inject a per-client pagination cursor across requests.
8. Question 8Development with AWS Services

   A developer is building a DynamoDB single-table design and needs to retrieve all items that share the same partition key but only a contiguous range of sort-key values. Which operation is most efficient and appropriate?

   • AScan with a FilterExpression that matches the partition key and the sort-key range
   • BQuery with a KeyConditionExpression using begins_with or BETWEEN on the sort keyCorrect
   • CBatchGetItem with a list of every key in the target sort-key range
   • DGetItem repeated in a loop over each sort-key value in the range
   ✓ Correct answer: B

   Query reads only the items matching the partition key and the sort-key condition, consuming capacity only for items returned, which is ideal for retrieving a range under one partition key. Sort-key operators like BETWEEN, begins_with, and comparison operators target contiguous ranges.

   Why the other options are wrong

   • AScan reads the entire table and filters after the read, so it is far less efficient than Query for a single partition.
   • CBatchGetItem requires you to enumerate exact primary keys and cannot express a contiguous sort-key range.
   • DLooping GetItem needs each full key and issues one request per item, wasting throughput versus a single Query.
9. Question 9Security

   A developer must call sts:GetSessionToken to obtain temporary credentials gated by MFA for an IAM user. Which parameter supplies the one-time code from the user's MFA device?

   • A--token-code together with --serial-numberCorrect
   • B--external-id
   • C--role-session-name plus --duration-seconds
   • D--policy-arns
   ✓ Correct answer: A

   To produce MFA-protected session credentials, you pass the MFA device's ARN with --serial-number and the current six-digit code with --token-code. The resulting temporary credentials then satisfy policy conditions requiring aws:MultiFactorAuthPresent.

   Why the other options are wrong

   • B--external-id is used with AssumeRole for third-party scenarios, not GetSessionToken.
   • C--role-session-name belongs to AssumeRole rather than GetSessionToken, and --duration-seconds sets the credential lifetime; neither carries the one-time code from the MFA device.
   • D--policy-arns scopes session permissions but does not carry the MFA code.
10. Question 10Troubleshooting and Optimization

    A Lambda function reads many small items from DynamoDB one at a time in a loop, and latency is high under load. Which change most directly reduces the number of round trips and improves read throughput?

    • AReplace the individual GetItem calls with a single BatchGetItem requestCorrect
    • BSwitch the table from on-demand to provisioned capacity mode
    • CEnable DynamoDB Streams on the table
    • DIncrease the Lambda function timeout
    ✓ Correct answer: A

    BatchGetItem lets the application fetch up to 100 items (or 16 MB) in a single API call, drastically reducing network round trips compared to many sequential GetItem calls. Fewer round trips lowers end-to-end latency for read-heavy loops.

    Why the other options are wrong

    • BCapacity mode affects throttling and cost, not the number of round trips a loop makes.
    • CStreams capture change events for consumers; they do not speed up reads of existing items.
    • DA longer timeout masks the symptom without reducing the actual per-item latency.

Who this AWS DVA-C03 practice exam is for

This practice set is for anyone preparing for the AWS DVA-C03: Developer Associate exam at the intermediate level - from first-time candidates building a foundation to experienced AWS practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AWS DVA-C03 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AWS DVA-C03 exam.

Related AWS resources

• AWS DVA-C03 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AWS MLA-C02 practice examRelated
• AWS SAA-C03 practice examRelated
• AWS SAP-C03 practice examRelated

AWS DVA-C03 practice exam FAQ