DVA-C02 Practice Questions

Question 1

A developer is creating an API with Amazon API Gateway that needs to accept binary data (e.g., images) and store them directly in an S3 bucket. The developer wants to minimize backend complexity. Which integration type should be used?

Accepted Answer

AWS service integration with S3. AWS service integration with S3 allows API Gateway to directly proxy binary data (e.g., images) to an S3 bucket without invoking a Lambda function or other backend. This minimizes backend complexity because the API Gateway handles the request transformation and passes the payload directly to S3 via the PutObject API action, eliminating the need for custom code.

Answer

Lambda proxy integration

Answer

HTTP integration

Answer

Mock integration

Question 2

Which TWO AWS services can be used to automatically deploy code to Amazon EC2 instances? (Choose two.)

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is a PaaS service that automates the deployment of applications to EC2 instances by handling capacity provisioning, load balancing, and health monitoring. It automatically deploys code when you upload a new application version, making it a correct choice for automated deployment to EC2.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS CodeBuild

Question 3

A developer is using AWS CodePipeline to deploy a web application. The pipeline has stages: Source, Build, Staging Deploy, Staging Test, and Prod Deploy. The developer wants to ensure that if the Staging Test stage fails, the pipeline automatically stops and does not proceed to Prod Deploy. Which action should the developer take?

Accepted Answer

No action is needed; CodePipeline automatically stops on stage failure. AWS CodePipeline's default behavior is to stop execution when a stage fails, preventing the pipeline from proceeding to subsequent stages. When the Staging Test stage fails, the pipeline transitions to a 'Failed' status and does not automatically continue to Prod Deploy. No additional configuration is required for this behavior.

Answer

Add a manual approval step before Prod Deploy

Answer

Disable the transition from Staging Test to Prod Deploy

Answer

Configure the pipeline execution mode to 'Superseded'

Question 4

A developer is building a serverless application using API Gateway and Lambda. The API must be accessed only by authenticated users from a specific AWS Cognito User Pool. Which method should be used?

Accepted Answer

Configure a Cognito Authorizer on the API Gateway method.. API Gateway can use a Cognito Authorizer to validate tokens from a specific user pool.

Answer

Create a Lambda authorizer that checks the token against Cognito.

Answer

Use an IAM authorizer with a policy that allows only Cognito roles.

Answer

Use a resource policy on API Gateway to restrict by source IP.

Question 5

A developer needs to grant an IAM role in the same AWS account read-only access to objects in a specific S3 bucket. The bucket is configured with a bucket policy that has an explicit Deny statement denying all principals except the root user. Which approach should the developer use to grant the required access?

Accepted Answer

Modify the bucket policy to allow the IAM role explicitly, or remove the Deny statement. The bucket policy contains an explicit Deny that overrides any allow permissions, including those granted by an IAM policy attached to the role. To grant the IAM role read-only access, the developer must either remove the Deny statement or add an explicit Allow for the role in the bucket policy, because an explicit Deny in a resource-based policy cannot be overridden by an identity-based policy.

Answer

Attach an IAM policy to the role that allows s3:GetObject on the bucket

Answer

Use an S3 access point instead of the bucket directly

Answer

Make the bucket public to allow all access

Question 6

A team uses AWS CodeCommit for source control and wants to automatically trigger a build and deployment when code is pushed to the master branch. Which AWS service should be used to create this automation?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that can be configured to automatically start a pipeline execution when a change is pushed to a specific branch in AWS CodeCommit. By setting the source stage to the CodeCommit repository and master branch, CodePipeline triggers subsequent build and deploy actions without manual intervention, enabling a complete CI/CD workflow.

Answer

AWS CodeBuild

Answer

AWS Lambda

Answer

AWS CodeDeploy

Question 7

A developer is deploying a web application using AWS Elastic Beanstalk. Which TWO configuration files can be used to customize the software that runs on the EC2 instances? (Select TWO.)

Accepted Answer

.platform/hooks/. The `.platform/hooks/` directory is a feature of Elastic Beanstalk's platform-specific configuration that allows you to run custom scripts at specific lifecycle events (e.g., prebuild, postdeploy) on the EC2 instances. This is the modern replacement for the older `.ebextensions` approach for running commands during deployment, and it directly customizes the software running on the instances.

Answer

Dockerfile

Answer

appspec.yml

Answer

buildspec.yml

Question 8

A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?

Accepted Answer

Enable encryption at rest when creating the DB instance.. Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.

Answer

Encrypt individual tables using MySQL native encryption.

Answer

Enable encryption at rest after the DB instance is created.

Answer

Use client-side encryption to encrypt data before sending to RDS.

Question 9

A developer is trying to update a CloudFormation stack that includes a Lambda function. The stack rolls back with the error shown. What is the most likely cause?

Accepted Answer

The Lambda function's execution role does not have a trust policy that allows Lambda to assume it.. The error message indicates that the IAM role cannot be assumed by Lambda. This typically means the trust policy of the execution role does not include 'lambda.amazonaws.com' as a trusted entity. Option A is incorrect because the error is about assuming the role, not about writing logs. Option B is incorrect because the error is not about the deployment package location. Option C is incorrect because the error is not about code size.

Answer

The Lambda function's execution role lacks permissions to write logs to CloudWatch.

Answer

The Lambda function's deployment package is not stored in Amazon S3.

Answer

The Lambda function's code is too large for the deployment.

Question 10

A developer is building a serverless application using AWS Step Functions. The workflow must execute hundreds of thousands of short-lived tasks per day, each taking less than 30 seconds. The tasks need to run in parallel, and a small number of duplicate executions are acceptable. Which type of Step Functions workflow should the developer choose?

Accepted Answer

Express Workflow. Express Workflows are designed for high-volume, short-duration (under 5 minutes) event-processing workloads, executing hundreds of thousands of state transitions per second with at-least-once semantics. Since the tasks are short-lived (under 30 seconds), run in parallel, and tolerate a small number of duplicate executions, Express Workflow is the correct choice because it offers lower cost and higher throughput than Standard Workflow, which guarantees exactly-once execution and is better suited for long-running, auditable workflows.

Answer

Standard Workflow

Answer

AWS Lambda function with synchronous invocation

Answer

Amazon Simple Workflow Service (SWF)

Question 11

A developer is writing a Lambda function that processes images uploaded to an S3 bucket. The function needs to extract metadata from the image. Which S3 feature can be used to automatically trigger the Lambda function?

Accepted Answer

S3 Events. Amazon S3 Events can be configured to send a notification when an object is created (e.g., via PutObject) in an S3 bucket. This event can directly invoke an AWS Lambda function, making it the correct service to automatically trigger the function upon image upload. The developer simply needs to set up an S3 event notification with the Lambda function as the destination.

Answer

S3 Inventory

Answer

S3 Transfer Acceleration

Answer

S3 Batch Operations

Question 12

A company is deploying a critical application using AWS CloudFormation. The stack creation fails due to a resource creation failure. The developer needs to troubleshoot the issue. Which TWO actions should the developer take to identify the root cause? (Choose TWO.)

Accepted Answer

View the stack events in the CloudFormation console.. Option A is correct because CloudFormation records every resource-level status transition (CREATE_IN_PROGRESS, CREATE_FAILED, etc.) as a stack event, and the event for the failed resource includes the exact StatusReason returned by the underlying service, which is the fastest way to pinpoint the root cause. Option D is correct because a resource creation failure is frequently caused by an invalid template definition — for example a bad property value, an incorrect intrinsic function reference, or a missing required parameter — so reviewing the template for logical errors validates the resource configuration against the service's requirements. Option B is not appropriate because stack outputs are only populated after resources are successfully created and are not generated for a failed stack, so they contain no troubleshooting data. Option C is not appropriate because deleting and recreating with identical parameters reproduces the same failure without gathering any diagnostic information. Option E is not appropriate because CloudTrail logs API calls made to AWS services (such as CreateStack), not the internal per-resource failure reasons that CloudFormation surfaces in stack events.

Answer

Check the stack outputs.

Answer

Delete the stack and recreate it with the same parameters.

Answer

Check AWS CloudTrail logs for the stack creation attempt.

Question 13

A developer is designing a system to store sensitive user data in Amazon S3. The data must be encrypted at rest and the encryption keys must be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon S3 SSE-KMS. Option A (Amazon S3 SSE-KMS) is correct because server-side encryption with AWS KMS keys (SSE-KMS) encrypts objects at rest in S3 and supports automatic annual key rotation when the underlying KMS customer managed key has rotation enabled. Option D (AWS KMS) is correct because it is the service that creates and manages the customer managed keys used for encryption and provides built-in annual automatic key rotation (every 365 days) for symmetric KMS keys. Option B (AWS Secrets Manager) is not for encrypting S3 object data at rest; it stores and rotates secrets such as database credentials. Option C (AWS Certificate Manager) manages TLS/SSL certificates for encryption in transit, not S3 data-at-rest encryption keys. Option E (AWS CloudHSM) provides dedicated hardware security modules and does not by itself deliver S3 at-rest encryption with annual key rotation as required.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 14

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The developer wants to enable caching for API responses to reduce latency and cost. Which step is REQUIRED to enable caching?

Accepted Answer

Create a cache cluster in API Gateway for the stage. API Gateway caching requires a dedicated cache cluster to be enabled and configured at the stage level. This cluster stores API responses and serves them directly from the cache for identical requests, reducing the number of calls to the backend Lambda function and lowering latency. Without creating and enabling this cache cluster in the API Gateway stage settings, caching cannot function.

Answer

Enable caching in the Lambda function code

Answer

Set the TTL in the API Gateway method request integration

Answer

Use Amazon ElastiCache and modify the Lambda function to check cache

Question 15

A company is deploying a new web application on Amazon EC2 instances behind an Application Load Balancer. The application must be deployed with no downtime. The deployment uses AWS CodeDeploy with a Blue/Green deployment configuration. Which TWO actions should be taken to achieve zero-downtime deployment? (Choose TWO.)

Accepted Answer

Create a new Auto Scaling group with the new application version and register it with the ALB.. Option B is correct because a CodeDeploy blue/green deployment for EC2 requires provisioning a replacement environment — a new Auto Scaling group running the new application revision — and registering it with the existing Application Load Balancer so it can serve traffic. Option E is correct because zero downtime is achieved by having the ALB gradually shift traffic from the original (blue) target group to the replacement (green) target group, using CodeDeploy's traffic-shifting controls (e.g., all-at-once, linear, or canary) before the old instances are terminated. Option A is wrong because creating a separate load balancer is unnecessary and would not provide the controlled traffic rerouting that CodeDeploy performs through the ALB's target groups. Option C is wrong because updating the existing Auto Scaling group in place is an in-place deployment, not blue/green, and would replace instances without the parallel green environment needed for zero downtime. Option D is wrong because terminating the old instances immediately removes the safety net and can cause dropped connections; the original environment must be kept until traffic has fully shifted and the deployment succeeds.

Answer

Create a new load balancer for the new environment.

Answer

Update the existing Auto Scaling group with the new application version.

Answer

Terminate the old EC2 instances immediately after deploying the new ones.

AWS Certified Developer Associate DVA-C02 practice test

Three ways to study

Study DVA-C02 by domain

Study DVA-C02 by topic

Troubleshooting and Optimization practice questions

Development with AWS Services practice questions

Security practice questions

Deployment practice questions

DVA-C02 fundamentals practice questions

DVA-C02 scenario practice questions

DVA-C02 troubleshooting practice questions

Top DVA-C02 questions

AWS Certified Developer Associate DVA-C02 practice questions