DVA-C02 Development with AWS Services practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

DVA-C02 Development with AWS Services: 424 practice questions

DVA-C02 424 questions 12 shown free

12 of the 424 Development with AWS Services questions in the Certsqill DVA-C02 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for DVA-C02? Take the free 5-min readiness check →

1. Increase the function's configured memory allocation: Which configuration change most directly increases the C

Medium
A developer operates a CPU-bound Lambda function that processes images. Warm invocations take too long, and downstream services respond normally. Which configuration change most directly increases the CPU resources available to each invocation?
  1. Increase the function's configured timeout value.
    A longer timeout permits an invocation to run longer, but it does not add CPU capacity. It does not directly address the CPU-bound processing bottleneck.
  2. Configure provisioned concurrency for the function.
    Provisioned concurrency prepares execution environments before requests arrive, reducing startup latency. It does not increase the CPU capacity used during this CPU-bound processing.
  3. Configure reserved concurrency for the function.
    Reserved concurrency reserves capacity and limits maximum concurrent executions. It can protect downstream resources, but it does not increase the CPU power available to each invocation.
  4. Increase the function's configured memory allocation. ✓
    Lambda allocates CPU power in proportion to configured memory. Increasing memory can therefore provide more CPU capacity for this CPU-bound workload and shorten invocation processing time.
The trap
For CPU-bound Lambda workloads, evaluate memory before changing timeout or concurrency settings.

Increasing Lambda memory is the direct way to increase CPU power for a CPU-bound function.

2. Store the API key in Secrets Manager: Which solution meets these requirements?

Medium
A Lambda function calls a third-party payment API. The API key must not appear in the deployment package, and the payment provider rotates the key periodically. The team wants to reduce repeated secret-service calls while ensuring the function eventually observes rotations. Which solution meets these requirements?
  1. Store the API key in Secrets Manager, retrieve it at runtime, and use client-side caching with a refresh interval. ✓
    Secrets Manager supports runtime retrieval instead of hard-coding secrets in application code or deployment artifacts. Client-side caching reduces retrieval latency and API-call cost, while refreshing allows rotated values to be observed.
  2. Assign the Lambda function an IAM role and use its temporary credentials as the payment API key.
    IAM roles provide temporary AWS credentials for workloads, whereas the payment provider requires its own API key. The third-party secret should be retrieved from a secret-management service at runtime.
  3. Store the API key as a Lambda environment variable encrypted with a customer managed KMS key.
    Lambda encrypts environment variables at rest and supports customer managed KMS keys, but this approach does not use the stated runtime secret-retrieval and refresh behavior for a periodically rotated key.
  4. Embed the API key in the deployment package and replace the package whenever the provider rotates the key.
    Embedding the key keeps a long-lived secret in source or deployment artifacts. Runtime retrieval through Secrets Manager avoids hard-coding credentials in those locations.
The trap
Encryption at rest protects stored values; it does not replace runtime secret management or rotation-aware retrieval.

Use Secrets Manager for runtime retrieval and client-side caching with refresh to balance rotation visibility, latency, and API-call cost.

3. Use a conditional update that compares the stored version: Which mechanism should reject an update if another

Medium
Two clients read the same DynamoDB inventory item, including its version attribute. Each client prepares an update based on that version. Which mechanism should reject an update if another client has already changed the stored version?
  1. A global secondary index on the inventory item
    A global secondary index supplies an alternate key for query access patterns; it does not provide the required conditional write behavior.
  2. Use a conditional update that compares the stored version with the version previously read. ✓
    Checking the expected version prevents an update based on an obsolete item version.
  3. Use TransactWriteItems with an Update action that has no condition expression.
    An unconditional transactional update does not check that the version read earlier is still current.
  4. An eventually consistent query against a global secondary index
    Global secondary index queries support only eventually consistent reads, which does not enforce a condition on the item during a write.
The trap
Match a current-item precondition to a DynamoDB condition expression, not to an index or read-consistency setting.

Use a conditional write because DynamoDB evaluates its condition against the current item before performing the write.

4. Use AWS Step Functions to coordinate the Lambda workflow: Which solution best meets the requirement?

Hard
A development team runs a multi-step order workflow across several Lambda functions. Lambda environments can be replaced between steps. The workflow requires branching, retries, and error handling, and the team wants these execution details managed without writing custom orchestration-state code. Which solution best meets the requirement?
  1. Store intermediate workflow files in each Lambda container’s /tmp directory.
    The /tmp directory provides writable temporary storage for a Lambda container, but it is ephemeral and does not provide the managed workflow coordination required here.
  2. Use DynamoDB TransactWriteItems for each group of workflow state updates.
    TransactWriteItems makes multiple DynamoDB writes all-or-nothing, but transaction atomicity does not itself coordinate workflow steps, branching, retries, and error handling.
  3. Use an ElastiCache lazy-loading strategy for the workflow execution state.
    Lazy loading populates a cache on demand and describes a cache population strategy; it does not provide workflow branching, retries, or error-handling orchestration.
  4. Use AWS Step Functions to coordinate the Lambda workflow and manage its execution state. ✓
    Step Functions coordinates distributed application components as workflows and provides state, branching, retries, and error handling, keeping orchestration state outside replaceable compute environments.
The trap
Distinguish workflow coordination requirements from temporary storage, caching, and database transaction requirements.

AWS Step Functions is designed to manage distributed workflow state and orchestration behavior independently of ephemeral Lambda environments.

5. Create an S3 gateway VPC endpoint and associate it: Which configuration provides this connectivity?

Easy
A Lambda function is attached to private subnets in a VPC. It needs access to Amazon S3 in the same Region without sending traffic through a NAT gateway or the internet. Which configuration provides this connectivity?
  1. Mount an Amazon EFS access point on the function.
    EFS provides shared file access; it does not provide network connectivity to S3.
  2. Move the function to a public subnet with an internet gateway route.
    A VPC-connected Lambda function does not receive a public IP address merely by using a public subnet.
  3. Configure an outbound-only security group rule for HTTPS.
    A security group permits traffic but does not create the route to S3.
  4. Create an S3 gateway VPC endpoint and associate it with the relevant route tables. ✓
    The gateway endpoint supplies an S3 route without a NAT gateway or internet gateway.
The trap
Separate the network route from permissions that authorize an S3 operation.

An S3 gateway endpoint supplies private S3 connectivity for the VPC.

6. Use envelope encryption: Which approach meets these requirements?

Medium
An application must encrypt sensitive records in the application before persisting them in a data store. The application must retain its encrypted data key alongside each record. The design must avoid retaining plaintext data-encryption keys while allowing the application to decrypt records when authorized. Which approach meets these requirements?
  1. Store the records in Secrets Manager and retrieve them at runtime whenever the application needs to decrypt them.
    Secrets Manager is intended to store credentials and other secrets for runtime retrieval instead of hard-coding them; this does not describe encrypting application records with a separately protected data key.
  2. Store the records as Parameter Store SecureString values and retrieve the encrypted configuration whenever the application needs the records.
    SecureString stores configuration values; it does not implement the requested application ciphertext and data-key layout.
  3. Use envelope encryption: encrypt the records with a data key, encrypt that data key with a KMS key, and store the encrypted data key with the ciphertext. ✓
    Envelope encryption uses a data key for application data and a KMS key for the data key. The encrypted data key can be stored with the ciphertext, while plaintext data keys are not retained.
  4. Store the records in Amazon S3 and issue a presigned URL whenever a client needs to access the records.
    A presigned URL grants time-limited access to a specific S3 operation using the creator's permissions; it provides delegated access, not the required application-data encryption and data-key handling design.
The trap
Distinguish encrypting application data from storing secrets or granting temporary object access.

Envelope encryption separates data protection from key protection: a data key encrypts the records, and a KMS key encrypts the data key.

7. Use lazy loading with a time-to-live for cached items: Which caching strategy best meets these requirements?

Hard
A developer is adding caching to a read-heavy application. The application should cache an item only after it is requested, and the team accepts that an item can remain stale for a limited period. Database writes must not perform an additional cache update. Which caching strategy best meets these requirements?
  1. Use write-through caching with a time-to-live (TTL) for cached items.
    Write-through updates the cache whenever the database is written, which adds the database-write behavior the requirements exclude. TTL addresses staleness but does not change that write behavior.
  2. Use a CloudFront cache key containing every request header and query string.
    Including every request value creates unnecessary duplicate cache objects when those values do not affect the origin response. The cache key should include only response-affecting values.
  3. Use lazy loading with a time-to-live (TTL) for cached items. ✓
    Lazy loading populates the cache on demand, matching the requirement to cache requested items only. A TTL can limit how long stale data remains cached.
  4. Use client-side Secrets Manager caching with periodic refresh.
    Client-side Secrets Manager caching is intended to reduce secret-retrieval latency and API-call cost, with refresh needed to observe rotations. It does not describe the application-data caching strategy required here.
The trap
Distinguish lazy loading, which populates on reads, from write-through, which updates the cache on database writes.

Lazy loading caches data on demand, and TTL limits the duration of stale entries without requiring cache updates on every database write.

8. Enable an API Gateway request validator for required: Which configuration best meets this requirement?

Medium
A developer maintains an API Gateway REST API endpoint that accepts JSON requests. The backend currently receives requests with missing required parameters, increasing unnecessary processing and producing avoidable errors. The developer must reject requests that fail required-parameter or request-body checks before the backend integration runs. Which configuration best meets this requirement?
  1. Enable an API Gateway request validator for required parameters and the request-body schema. ✓
    Request validators can check required request parameters and request-body schemas before invoking the backend integration, allowing invalid requests to be rejected at the API boundary.
  2. Configure API Gateway token-bucket throttling with stage-level rate and burst limits.
    Throttling controls request rates and bursts and can return HTTP 429 when targets are exceeded; it does not validate required parameters or request-body schemas.
  3. Add an AWS AppSync GraphQL resolver to validate the API request before processing.
    AppSync resolvers connect GraphQL schema fields to data sources and handle requests and responses; they are not the API Gateway request-validation mechanism described in this requirement.
  4. Create a separate API Gateway stage with stage variables for the backend endpoint.
    Stages provide named deployment environments with stage-specific configuration and variables, but those settings do not perform request-parameter or body-schema validation.
The trap
Distinguish request validation from throttling: validation checks request structure, while throttling controls request volume.

Use an API Gateway request validator because it checks required parameters and request-body schemas before backend invocation.

9. Enable ReportBatchItemFailures on the event source mapping: Which implementation change MOST reduces unnecessa

Hard
A Lambda function processes batches of messages from an Amazon SQS standard queue. Each batch contains 10 messages. A downstream service intermittently fails for one message, while the other nine messages complete successfully. The team observes that successful messages are processed again whenever one message fails. Which implementation change MOST reduces unnecessary reprocessing while preserving reliable processing of the failed message?
  1. Make the function idempotent so repeated processing produces the same result.
    Idempotency is required because SQS and Lambda can deliver messages more than once, but it tolerates duplicate work rather than preventing successful records from being retried with a failed record.
  2. Replace the queue integration with an EventBridge rule targeting the function.
    EventBridge rules match events and can send matching events to multiple targets, but this change does not provide the SQS batch-failure behavior needed to isolate one failed message from nine successful messages.
  3. Increase the queue visibility timeout beyond the function's maximum processing duration.
    A longer visibility timeout can reduce premature redelivery when processing exceeds the timeout, but it does not prevent successful records in a failed batch from being retried. Visibility only hides a message temporarily until deletion or timeout expiry.
  4. Enable ReportBatchItemFailures on the event source mapping and return only failed message identifiers. ✓
    Both the mapping configuration and a correctly formed batchItemFailures response are needed to retry only failed records.
The trap
Separate retry isolation from duplicate-tolerance: partial batch responses isolate failures, while idempotency handles duplicates.

Use Lambda's partial batch failure response to identify only failed SQS records for retry.

10. Amazon Q Developer: Which AWS service is designed for this purpose?

Medium
A developer wants assistance explaining existing code, generating code, and improving code and tests. Which AWS service is designed for this purpose?
  1. Amazon Q Developer ✓
    Amazon Q Developer assists with explaining, generating, and improving code and tests. Its generated output still requires developer review and testing before release.
  2. AWS SAM CLI
    The AWS SAM CLI supports local testing and step-through debugging for serverless applications, rather than serving as the described coding-assistance capability.
  3. AWS CodePipeline
    AWS CodePipeline automates release workflows through ordered stages and actions that pass artifacts between stages; it does not provide the stated code-generation and code-improvement assistance.
  4. AWS CodeBuild
    AWS CodeBuild uses a buildspec file to define build phases, commands, artifacts, and related settings; it is a build service, not the coding assistant described.
The trap
Distinguish coding assistance from local debugging, build execution, and release orchestration.

Amazon Q Developer is designed to explain, generate, and improve code and tests. Developers must review and test its output.

11. Configure API destination retries and attach a standard: Which configuration best meets these requirements?

Medium
A developer sends events to a third-party HTTP endpoint through an EventBridge API destination. The endpoint sometimes returns transient failures, and the team must retain events that remain undelivered after retries without writing custom orchestration code. Which configuration best meets these requirements?
  1. Configure a Step Functions workflow to call the endpoint and implement retry and error-handling states.
    Step Functions supports workflow state, branching, retries, and error handling, but this adds custom workflow orchestration when the API destination already provides the required retry behavior.
  2. Place events in an SQS standard queue and rely on the consumer to retry endpoint requests.
    SQS standard queues provide at-least-once delivery and best-effort ordering, so consumers should be idempotent; this does not configure EventBridge API-destination retries or its exhausted-event dead-letter handling.
  3. Configure API destination retries and attach a standard SQS dead-letter queue to the EventBridge target. ✓
    This uses EventBridge retry handling for selected transient HTTP failures and retains events that cannot be delivered in the target's standard SQS dead-letter queue.
  4. Store the endpoint credentials in Secrets Manager and use runtime retrieval for each request.
    Secrets Manager supports storing credentials and retrieving them at runtime instead of hard-coding them, but credential storage does not provide HTTP retry handling or retention of exhausted events.
The trap
Distinguish endpoint credential management from delivery retry and exhausted-event handling.

API destinations provide retry handling for selected transient HTTP failures, and an EventBridge target can use a standard SQS dead-letter queue for events that remain undelivered.

12. Use an IAM role attached through an EC2 instance profile: Which credential-sourcing approach requires the leas

Medium
A developer is deploying an application to an Amazon EC2 instance. The application must access AWS services without storing long-term access keys. Which credential-sourcing approach requires the least operational overhead?
  1. Embed long-term access keys in the application configuration.
    Embedded long-term keys create a persistent secret in the application and do not follow the recommended use of temporary credentials supplied through IAM roles.
  2. Call STS AssumeRole from the application for every AWS request.
    AssumeRole can provide temporary credentials, but the caller needs permission and must satisfy the target role trust policy; using the EC2 role provider avoids this unnecessary per-request design.
  3. Associate an IAM role with an EKS Kubernetes service account.
    EKS Pod Identity supplies temporary credentials to pods associated with Kubernetes service accounts, but the workload in this question runs directly on EC2.
  4. Use an IAM role attached through an EC2 instance profile. ✓
    An EC2 instance profile supplies the role to the instance, and the SDK can retrieve and automatically rotate temporary role credentials without stored long-term keys.
The trap
For applications on EC2, prefer an IAM role through an instance profile over stored access keys.

Use an IAM role attached through an EC2 instance profile so the SDK obtains and rotates temporary credentials automatically.

412 more Development with AWS Services questions

The remaining 412 questions in this domain are part of the full DVA-C02 bank — 1326 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your DVA-C02 readiness — free

Other DVA-C02 domains

Part of the Certsqill DVA-C02 question bank · Development with AWS Services · Every answer, right and wrong, comes with its own explanation.