DVA-C02 Practice Exam: 700 Questions with Explanations

1. A developer wants to invoke a Lambda function over HTTPS without setting up API Gateway, for a low-traffic internal tool. Which feature should the developer use?

1. An Application Load Balancer with a Lambda target group
2. Amazon CloudFront with a custom origin
3. Lambda function URLs, which provide a dedicated HTTPS endpoint with configurable auth (NONE or AWS_IAM)
4. AWS AppSync

2. A team wants immutable deployments on Beanstalk but their deployment takes 20 minutes due to a large fleet. They want to keep the safety of immutable while reducing deploy time. What is a reasonable optimization?

1. Add more instances to deploy faster
2. Reduce fleet size via right-sizing, or accept the time as the cost of immutable safety — alternatively use rolling with additional batch for a faster but slightly less isolated deployment
3. Switch to all-at-once, which is equally safe
4. Immutable deploy time cannot be influenced

3. A developer assumes a role with the default session duration. Sixty minutes later the application starts receiving expired-token errors. Why?

1. STS automatically renews the credentials in the background
2. The role was deleted after one hour
3. The temporary credentials expired; the application must call AssumeRole again for fresh credentials
4. The credentials converted into permanent IAM user keys

4. A security review requires that a Lambda function's environment variables containing database credentials be encrypted with a customer managed KMS key rather than the default AWS managed key. How should the team comply?

1. No action is needed; environment variables are never encrypted.
2. Move the credentials to the function's /tmp storage, which uses customer managed keys.
3. Store the credentials in AWS Secrets Manager and leave the environment variables as they are.
4. Configure a customer managed KMS key on the function's environment variable encryption settings, so Lambda uses it instead of the default AWS managed key.

5. A team runs an A/B test of two application versions for a week, routing 50% of users to each, then permanently adopts the winner. Which deployment concept does this resemble and what distinguishes it from blue/green?

1. It resembles blue/green's two-environment setup, but blue/green is a deployment safety technique with a quick cutover, whereas a week-long 50/50 split is an experimentation pattern, not a deployment strategy
2. It is exactly canary deployment, which always runs for a week
3. It is a rolling deployment with two batches
4. It is an immutable deployment because two fleets exist

6. Which of the following is a managed policy?

1. An AWS managed policy such as AmazonS3ReadOnlyAccess that AWS maintains and updates centrally
2. An inline policy embedded directly in a single IAM user
3. A bucket policy attached to an S3 bucket
4. A permissions boundary document

7. A mobile app lets users sign in with Google and then upload photos directly to S3. Which STS operation gives the app temporary AWS credentials after Google authentication?

1. AssumeRole
2. GetSessionToken
3. AssumeRoleWithSAML
4. AssumeRoleWithWebIdentity

8. A team debates rolling vs. immutable for their Beanstalk application. Their top priority is the safest possible deployment and cost is a secondary concern. Their second priority is fast rollback. Which should they choose and why?

1. Rolling, because it is the safest strategy available on Beanstalk
2. All at once, because it completes fastest and therefore has the smallest failure window
3. Rolling with additional batch, because it never provisions new instances
4. Immutable, because the old fleet stays intact until the new fleet is verified, making rollback a simple traffic shift back

9. During flash-sale spikes, an application intermittently receives ProvisionedThroughputExceededException from DynamoDB. The exceptions clear on their own within seconds, and overall consumed capacity stays within provisioned limits. What is the most appropriate client-side handling?

1. Let the AWS SDK retry throttled requests with exponential backoff and jitter, and use Contributor Insights to find any hot keys driving the spikes
2. Disable SDK retries so failures surface immediately and operators can raise capacity manually
3. Switch all reads to strongly consistent to reduce the number of retryable errors
4. Increase the Lambda function timeout so requests wait longer for capacity

10. A Lambda function needs 2 vCPUs for a compute-heavy task. What should the developer know about Lambda CPU allocation?

1. CPU is fixed at 1 vCPU regardless of memory
2. CPU can be set independently via the console
3. CPU scales proportionally with memory; at about 3 GB the function gets roughly 2 vCPUs, so there is no separate CPU setting
4. Graviton must be enabled for 2 vCPUs

11. What is the difference between an identity pool's authenticated role and unauthenticated role?

1. The authenticated role serves signed-in users with broader permissions, while the unauthenticated role serves guests with minimal permissions
2. They are the same role under two names
3. The unauthenticated role receives administrative permissions
4. Roles are optional in identity pools

12. A developer runs a database migration that must execute exactly once per deployment, after the new code is in place but before traffic shifts. In Beanstalk, where should this go?

1. A commands: entry, which runs on every instance on every deploy including scaling events
2. In the Dockerfile CMD
3. As a cron job on the instances
4. A container_command in .ebextensions, which runs once per deployment on the instance (leader-only for multi-instance via leader election)

13. During load testing, an API's p99 Latency metric climbs to 2.5 seconds while IntegrationLatency for the same period stays under 200 ms. The integration is a Lambda function that logs show completes quickly. Where should the developer investigate?

1. The Lambda function's cold starts, because IntegrationLatency excludes them
2. The DynamoDB table the Lambda reads from, since slow queries inflate API Gateway latency
3. Processing that happens inside API Gateway before or after the integration call, such as the Lambda authorizer, request/response mapping templates, or throttling delays
4. The client's network connection, because the Latency metric is measured at the client's device

14. An EKS cluster runs microservices that need access to DynamoDB and S3 without storing any AWS keys in the cluster. Which approach is correct?

1. Create an IAM user for each pod and mount its keys as a secret
2. Store long-lived access keys in the cluster's Secrets Manager
3. Use IAM roles for service accounts (IRSA), mapping Kubernetes service accounts to IAM roles through the cluster's OIDC provider
4. Use the account's root credentials in a DaemonSet

15. A developer publishes a Lambda version after testing. A teammate asks whether the code of that published version can be edited later to fix a bug. What is the correct answer?

1. Published Lambda versions are immutable; the developer must publish a new version with the fix
2. Yes, versions can be edited in the console at any time
3. Only the $LATEST version is immutable
4. Versions auto-update when the underlying runtime is patched

16. A developer wants messages that fail processing after 5 attempts to be isolated for inspection. What should be configured?

1. A FIFO queue
2. A dead-letter queue with maxReceiveCount=5 on the source queue's redrive policy
3. Long polling
4. Message timers

17. A developer wants to prevent any stack update from replacing a production database, while still allowing other updates. Which is the right control?

1. Setting the stack to REVIEW_IN_PROGRESS
2. A stack policy denying Update:Replace on the database resource
3. DeletionPolicy: Delete on the database
4. Removing the database from the template

18. A startup wants the cheapest, lowest-latency option for a simple Lambda-backed JSON API with JWT authorization and no need for usage plans. Which should they choose?

1. REST API with caching enabled
2. HTTP API, which offers lower latency and cost than REST APIs with JWT authorizer support
3. WebSocket API
4. Application Load Balancer

19. A team defines their API in an OpenAPI 3.0 specification and wants to import it into API Gateway to create the methods and models automatically. What should they do?

1. Manually recreate each method
2. Use CloudFormation only for Lambda
3. Use the API Gateway import API or console import, which creates resources and methods from the OpenAPI definition
4. Export from CloudWatch

20. Two warehouse scanners can update the same inventory item's quantity simultaneously. The team added a versionNumber attribute and wants an update to succeed only if the version has not changed since it was read, retrying on conflict. Which DynamoDB feature implements this optimistic locking?

1. Strongly consistent reads, which serialize concurrent writers
2. TransactWriteItems across the item and a lock record
3. Enabling DynamoDB Streams to detect conflicting writes after the fact
4. An UpdateItem with a ConditionExpression such as versionNumber = :expected, incrementing the version on each successful write

21. A code review finds AWS access keys committed in the application source. What is the complete remediation?

1. Leave them — the repository is private
2. Rotate the keys next quarter
3. Add a code comment warning future developers
4. Remove the keys from the code immediately, revoke and rotate them, replace them with IAM roles or Secrets Manager, and scan the repository history for other exposures

22. What can a resource policy on an API Gateway REST API do?

1. Replace the need for authorizers entirely
2. Issue bearer tokens to clients
3. Encrypt request payloads
4. Allow or deny invocation based on source IP, VPC/VPC endpoint, or AWS principal — evaluated before authorizers run

23. A pipeline execution is stuck: the deploy action has been running for an hour against an unhealthy environment, and the team wants to stop it immediately without deleting the pipeline. What should they do?

1. Disable the pipeline's source trigger so no new executions start
2. Stop the pipeline execution from the pipeline's execution history in the console or CLI
3. Delete the deploy action from the pipeline definition to cancel the run
4. Wait for the action to time out, since executions cannot be stopped manually

24. A developer enables caching on a REST API method to reduce backend load. A client reports seeing another user's data in a cached response. What is the MOST likely cause?

1. Caching is not supported on REST APIs
2. The TTL is too long
3. The cache key does not include the Authorization header or user-identifying parameter, so responses are shared across users
4. Lambda concurrency is too low

25. A developer needs to copy a DynamoDB table's data to another account for migration. Which approach is simplest and serverless?

1. Manual retyping
2. DAX replication
3. Email CSVs
4. Export the table to S3, then import from S3 into the destination table (DynamoDB import from S3)

26. A worker queue processes image-resize jobs. Occasionally a corrupt image makes the consumer crash; the message becomes visible again, gets picked up, and crashes the consumer in an endless cycle, blocking healthy messages behind it in a FIFO queue. How should the developer isolate these poison messages?

1. Increase the visibility timeout to 12 hours so the poison message stays hidden longer
2. Configure a redrive policy on the source queue with a maxReceiveCount (for example 3), routing repeatedly-failing messages to a dead-letter queue for inspection
3. Enable content-based deduplication so the corrupt image is only delivered once
4. Shorten the message retention period so poison messages expire quickly

27. A message in an SQS queue is picked up by a consumer but processing takes longer than the visibility timeout. What happens?

1. The message becomes visible again and may be delivered to another consumer, risking duplicate processing
2. The message is deleted
3. The queue is paused
4. The message is encrypted

28. A team wants deployments where a failed new version never touches production traffic, and they want the old environment preserved for instant rollback. They run on EC2 with a load balancer. Which strategy should they choose?

1. Blue/green: run the new version on a separate (green) environment, shift traffic only after validation, keep blue for instant rollback
2. Rolling: update instances in place behind the load balancer
3. All-at-once: fastest path to the new version
4. Rolling with additional batch: adds capacity during the update

29. How does Secrets Manager rotate credentials for an RDS database?

1. By running manual SQL supplied by the developer each time
2. From the developer's laptop over a VPN
3. With a Lambda rotation function — AWS supplies templates — that updates both the secret and the database password in a coordinated multi-step flow
4. Through IAM policy changes alone

30. A company requires cryptographic verification that only approved, signed Lambda deployment packages can run in production. Which feature should the developer use?

1. Environment variable encryption
2. VPC endpoints
3. Function URLs with AWS_IAM auth
4. AWS Lambda code signing with AWS Signer, which validates signatures before allowing deployment