AWS Certified Developer — Associate (DVA-C02) practice questions and exam guide

Which service orchestrates a state machine that calls multiple Lambdas with retries?

1. EventBridge scheduler cron rule
2. Systems Manager Automation doc
3. Step Functions state machine
4. AppFlow between SaaS apps

Answer: C — Step Functions state machine

A) EventBridge triggers events, not state. C) Correct — Step Functions defines Tasks with per-state retry policies. B) SSM Automation runs runbooks on instances. D) AppFlow moves data between SaaS apps.

Which API Gateway type is CHEAPEST and simplest for a REST-style Lambda-backed API?

1. REST API v1 edge-optimized
2. Private API with VPC link
3. WebSocket API stateful sockets
4. HTTP API v2 with Lambda proxy

Answer: D — HTTP API v2 with Lambda proxy

A) REST v1 costs more per million and adds features not always needed. D) Correct — HTTP API is cheaper and lower-latency for Lambda proxy patterns. C) WebSocket is for stateful sockets. B) Private APIs require VPC link.

Which S3 storage class transitions objects automatically between frequent and infrequent tiers?

1. S3 Standard single tier flat
2. S3 Standard-IA target tier
3. S3 Glacier Flexible Retrieval
4. S3 Intelligent-Tiering adaptive

Answer: D — S3 Intelligent-Tiering adaptive

A) Standard is single-tier at flat cost. B) Standard-IA is a target tier, not adaptive. D) Correct — Intelligent-Tiering moves objects based on access patterns. C) Glacier Flexible is archival with retrieval delay.

Which service is used to store and rotate an OAuth client secret used by a Lambda?

1. AWS Secrets Manager rotate secret
2. SSM Parameter Store String param
3. Amazon Cognito app client secret
4. AWS Certificate Manager cert store

Answer: A — AWS Secrets Manager rotate secret

B) String parameters are not encrypted by default. A) Correct — Secrets Manager stores, encrypts, and rotates arbitrary secrets. C) Cognito holds its own client secret. D) ACM issues TLS certificates.

Which pattern implements ENVELOPE encryption for large payloads?

1. Encrypt payload directly with KMS key
2. PutObject with SSE-S3 default
3. Sign payload with asymmetric key
4. GenerateDataKey then local encrypt

Answer: D — GenerateDataKey then local encrypt

A) KMS Encrypt is capped at 4 KB. D) Correct — envelope encryption encrypts data with a local data key and stores the KMS-wrapped key beside it. C) Signing proves authorship, not confidentiality. B) SSE-S3 isn't envelope as described.

Cognito Identity Pools exchange a user-pool ID token for what?

1. A permanent IAM access key
2. A signed URL for CloudFront path
3. A refresh token for the user pool
4. Temporary AWS credentials via STS

Answer: D — Temporary AWS credentials via STS

A) Permanent keys are never issued to end users. D) Correct — identity pools return short-lived STS credentials scoped by an IAM role. C) Refresh tokens are managed inside user pools. B) CloudFront signing is unrelated.

A CodeDeploy Lambda deployment with Canary10Percent5Minutes preset does what?

1. Shifts 5% traffic for 10 min then 100%
2. Shifts 10% traffic for 5 min then 100%
3. Deploys all at once with 5-min delay
4. Shifts 10% each minute over 10 min

Answer: B — Shifts 10% traffic for 5 min then 100%

B) Correct — 10% goes to the new version for 5 minutes; if alarms stay clean, 100% shifts next. A) Reverses the percentages. C) Would be All-at-once with delay. D) That describes a linear preset.

Which CodeBuild construct defines phases, artifacts, and env vars for a build?

1. buildspec.yml drives CodeBuild
2. appspec.yml is CodeDeploy artifact
3. template.yaml is SAM/CFN template
4. samconfig.toml stores CLI defaults

Answer: A — buildspec.yml drives CodeBuild

B) appspec is a CodeDeploy artifact. A) Correct — buildspec.yml governs CodeBuild install, pre_build, build, and post_build phases. C) template.yaml is SAM/CFN. D) samconfig.toml stores sam CLI defaults.

Which CloudFormation attribute retains a resource when the stack is DELETED?

1. UpdateReplacePolicy: Retain
2. DependsOn: Retain for ordering
3. DeletionPolicy: Retain the resource
4. Metadata: Retain informational

Answer: C — DeletionPolicy: Retain the resource

A) UpdateReplacePolicy governs replacements during updates, not deletion. C) Correct — DeletionPolicy: Retain preserves the resource after stack delete. B) DependsOn only orders creation. D) Metadata is informational.

Which HTTP status code from an SDK call indicates client-side throttling by the target AWS API?

1. HTTP 429 Too Many Requests
2. HTTP 403 Forbidden
3. HTTP 401 Unauthorized
4. HTTP 500 Internal Server

Answer: A — HTTP 429 Too Many Requests

C) 401 is unauthenticated. B) 403 is access denied. A) Correct — 429 TooManyRequests signals throttling; SDKs retry with backoff. D) 500 signals a server-side error.

A DynamoDB table has a hot partition. Which redesign spreads write load MOST effectively?

1. Enable point-in-time recovery
2. Enable eventually consistent reads
3. Increase provisioned RCUs only
4. Add a random suffix to partition-key value

Answer: D — Add a random suffix to partition-key value

A) PITR is a backup feature and does not affect hot keys. D) Correct — write sharding via a suffix (e.g., 0-9) distributes writes across many partitions. C) RCUs address read throttling, not write skew. B) Read consistency doesn't rebalance writes.

DynamoDB scans are slow and expensive. Data is filtered by a non-key attribute. BEST fix?

1. Create a GSI on that attribute
2. Increase table RCUs to speed scan
3. Run scans only during off-hours
4. Enable parallel scan on the table

Answer: A — Create a GSI on that attribute

B) More RCUs only make expensive scans faster, not cheaper. A) Correct — Query on a GSI is orders of magnitude cheaper than Scan. C) Off-hours doesn't help user latency. D) Parallel scan is still expensive.

CloudWatch Alarms?

Trigger actions when metric crosses threshold. Notify SNS, scale ASG, etc.

RDS Multi-AZ?

Synchronous replica in another AZ. Automatic failover. High availability.

KMS envelope encryption?

KMS key encrypts data key. Data key encrypts data. Efficient for large data.

What is AWS Developer Associate (DVA-C02)?

Cert for developers building applications on AWS. Covers SDK/CLI use, Lambda, API Gateway, DynamoDB, deployment, and troubleshooting.

API Gateway integration types?

Lambda proxy, Lambda non-proxy, HTTP, AWS service, mock, VPC link.

Redis vs Memcached?

Redis: persistence, pub/sub, complex types. Memcached: simple, multi-thread, no persistence.