AWS Certified Developer Associate DVA-C02 practice test

A developer is troubleshooting an AWS Lambda function that is triggered by an S3 event. The function occasionally fails with a timeout error. CloudWatch logs show that the timeout occurs during the processing of large files. The function has a memory setting of 128 MB and a timeout of 3 seconds. The developer wants to process large files without modifying the code. Which parameter should the developer adjust first?

Trap 1: Increase the function's timeout

Increasing timeout might prevent the error but does not address the underlying slowness; it is better to first try increasing memory.

Trap 2: Increase the function's reserved concurrency

Concurrency controls the number of simultaneous invocations, not the execution time of a single invocation.

Trap 3: Increase the S3 event notification batch size

S3 event notifications do not have a batch size; each event triggers a separate invocation.

A
Increase the function's memory
More memory provides more CPU, which can speed up processing and reduce the chance of timeout without code changes.
B
Increase the function's timeout
Why wrong: Increasing timeout might prevent the error but does not address the underlying slowness; it is better to first try increasing memory.
C
Increase the function's reserved concurrency
Why wrong: Concurrency controls the number of simultaneous invocations, not the execution time of a single invocation.
D
Increase the S3 event notification batch size
Why wrong: S3 event notifications do not have a batch size; each event triggers a separate invocation.

Question 2mediummultiple choice

A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use by default?

Trap 1: Static credentials committed to Git

This does not meet the stated requirement as directly as the correct option.

Trap 2: A credentials file copied into the AMI

This does not meet the stated requirement as directly as the correct option.

Trap 3: The root account access key

This does not meet the stated requirement as directly as the correct option.

A
Static credentials committed to Git
Why wrong: This does not meet the stated requirement as directly as the correct option.
B
A credentials file copied into the AMI
Why wrong: This does not meet the stated requirement as directly as the correct option.
C
The root account access key
Why wrong: This does not meet the stated requirement as directly as the correct option.
D
Temporary credentials from the instance profile role
Correct for the stated requirement.

Question 3mediummultiple choice

A developer needs to allow an IAM user in a different AWS account to assume a role in the developer's account. The role has permissions to access an S3 bucket. Which policy is required in the developer's account to enable this cross-account access?

Trap 1: An S3 bucket policy granting access to the external account

The bucket policy can grant direct access to the external user without assuming a role, but the question specifies using a role.

Trap 2: An IAM user policy in the external account allowing sts:AssumeRole

This policy is needed in the external account, not in the developer's account.

Trap 3: An AWS Organizations service control policy allowing cross-account…

SCPs are used to restrict permissions within an organization, not to grant trust relationships.

A
An IAM role with a trust policy that allows the external account's root user or specific IAM users/roles to assume the role
Correct. The trust policy on the role specifies which principals from other accounts can assume it.
B
An S3 bucket policy granting access to the external account
Why wrong: The bucket policy can grant direct access to the external user without assuming a role, but the question specifies using a role.
C
An IAM user policy in the external account allowing sts:AssumeRole
Why wrong: This policy is needed in the external account, not in the developer's account.
D
An AWS Organizations service control policy allowing cross-account access
Why wrong: SCPs are used to restrict permissions within an organization, not to grant trust relationships.

Read the full NAT/PAT explanation →

Question 4hardmultiple choice

A developer needs to grant an IAM role in Account B read-only access to objects in an S3 bucket in Account A. The bucket is encrypted with server-side encryption using AWS KMS (SSE-KMS) with a customer managed key (CMK) in Account A. Which combination of policies is required for the cross-account access to succeed?

Trap 1: The bucket policy in Account A grants s3:GetObject to the role, and…

The question specifies a customer managed key, which requires explicit key policy grants. AWS managed keys cannot be used in cross-account scenarios.

Trap 2: The bucket policy in Account A grants s3:GetObject to the role, and…

IAM roles require IAM policies to authorize actions, even if resource-based policies grant access. The role must have an IAM policy allowing s3:GetObject and kms:Decrypt.

Trap 3: Only the bucket policy in Account A needs to grant s3:GetObject to…

SSE-KMS with a customer managed key requires explicit KMS permissions. The default key (AWS managed key) cannot be used for cross-account access.

A
The bucket policy in Account A grants s3:GetObject to the role, the KMS key policy grants kms:Decrypt to the role, and the role in Account B has an IAM policy allowing s3:GetObject and kms:Decrypt
All three policies are required: bucket policy and key policy in Account A grant the necessary permissions, and the IAM role in Account B must have the corresponding IAM policy to authorize the use of those grants.
B
The bucket policy in Account A grants s3:GetObject to the role, and the role in Account B has an IAM policy allowing s3:GetObject. No KMS permissions are needed because SSE-KMS uses AWS managed keys by default.
Why wrong: The question specifies a customer managed key, which requires explicit key policy grants. AWS managed keys cannot be used in cross-account scenarios.
C
The bucket policy in Account A grants s3:GetObject to the role, and the KMS key policy grants kms:Decrypt to the role. The role in Account B does not need additional IAM policies because the bucket and key policies provide sufficient permissions.
Why wrong: IAM roles require IAM policies to authorize actions, even if resource-based policies grant access. The role must have an IAM policy allowing s3:GetObject and kms:Decrypt.
D
Only the bucket policy in Account A needs to grant s3:GetObject to the role. KMS is not involved because the bucket is encrypted with SSE-KMS but the role can decrypt using the default KMS key.
Why wrong: SSE-KMS with a customer managed key requires explicit KMS permissions. The default key (AWS managed key) cannot be used for cross-account access.

Question 5hardmultiple choice

An API Gateway HTTP API should allow access only to users authenticated by an external OIDC provider. Which authorizer type is most appropriate?

Trap 1: IAM authorizer

This does not meet the stated requirement as directly as the correct option.

Trap 2: API key authorizer

This does not meet the stated requirement as directly as the correct option.

Trap 3: S3 bucket policy

This does not meet the stated requirement as directly as the correct option.

A
IAM authorizer
Why wrong: This does not meet the stated requirement as directly as the correct option.
B
API key authorizer
Why wrong: This does not meet the stated requirement as directly as the correct option.
C
JWT authorizer configured for the issuer and audience
Correct for the stated requirement.
D
S3 bucket policy
Why wrong: This does not meet the stated requirement as directly as the correct option.

Question 6mediummultiple choice

A developer monitors an AWS Lambda function that processes messages from an Amazon SQS queue. CloudWatch logs show that the function's execution time has increased significantly over the past week, and it now frequently times out at the 5-minute timeout. The function's code has not been changed recently. The function makes calls to an Amazon DynamoDB table. What is the most likely cause of the increased execution time?

Trap 1: The SQS queue's visibility timeout is too short, causing duplicate…

A short visibility timeout could cause duplicate messages but would not directly increase execution time; it could even decrease it as messages are reprocessed.

Trap 2: The Lambda function's memory is too low, causing CPU throttling.

If memory were insufficient, the function would likely fail with out-of-memory errors, not consistently reach the 5-minute timeout.

Trap 3: The DynamoDB table's indexes are missing, causing full table scans.

Missing indexes could increase query time, but full table scans are only done with Scan operations, not typical Get/Query patterns. Also, this would not appear suddenly without code or schema changes.

A
The DynamoDB table's read capacity units are underprovisioned, causing throttling.
Underprovisioned capacity throttles read/write requests, causing Lambda to retry, increasing execution time and potentially causing timeouts.
B
The SQS queue's visibility timeout is too short, causing duplicate processing.
Why wrong: A short visibility timeout could cause duplicate messages but would not directly increase execution time; it could even decrease it as messages are reprocessed.
C
The Lambda function's memory is too low, causing CPU throttling.
Why wrong: If memory were insufficient, the function would likely fail with out-of-memory errors, not consistently reach the 5-minute timeout.
D
The DynamoDB table's indexes are missing, causing full table scans.
Why wrong: Missing indexes could increase query time, but full table scans are only done with Scan operations, not typical Get/Query patterns. Also, this would not appear suddenly without code or schema changes.