Try 12 AWS DVA-C02 sample questions, review developer associate scope across AWS SDKs, Lambda, APIs, deployment, storage, security, observability, and troubleshooting, and request an IT Mastery practice update.
DVA-C02 is AWS’s Developer Associate certification for candidates who need strong application-building judgment across AWS services, security, deployment, and troubleshooting.
Full app-backed IT Mastery practice for DVA-C02 is still being prioritized. You can review the exam snapshot, topic coverage, and related live AWS practice options.
DVA-C02 questions usually reward the option that is secure by default, operationally sensible, and aligned to AWS-native developer patterns instead of a generic code-centric shortcut.
| Domain | Weight |
|---|---|
| Development with AWS Services | 32% |
| Security | 26% |
| Deployment | 24% |
| Troubleshooting and Optimization | 18% |
Try these 12 original sample questions for AWS DVA-C02. They are designed for self-assessment and are not official exam questions.
What this tests: Lambda event handling and retry behavior
A developer is building an image-processing workflow. Objects uploaded to an S3 bucket should trigger processing, but occasional downstream failures should not lose events. Which design is the best fit?
Best answer: C
Explanation: SQS between S3 and Lambda gives the workflow buffering, retry control, visibility timeout handling, and a dead-letter path for failed messages. Direct S3-to-Lambda can work for simpler flows, but SQS is stronger when durability and failure isolation matter. Polling S3 or using local disk creates avoidable operational risk.
What this tests: IAM role design for application credentials
An application running on Amazon ECS needs to read one DynamoDB table and write logs to CloudWatch Logs. What is the most secure credential approach?
Best answer: A
Explanation: DVA-C02 expects role-based, least-privilege credential handling. An ECS task role provides temporary credentials scoped to the application task. Long-lived IAM user keys, broad instance-profile permissions, or baked credentials all increase exposure and are harder to rotate safely.
What this tests: API Gateway authorization choice
A public mobile app calls an Amazon API Gateway REST API backed by Lambda. Users sign in through Amazon Cognito user pools, and each API request must verify the user’s identity. Which option is most appropriate?
Best answer: D
Explanation: A Cognito authorizer lets API Gateway validate user pool tokens before invoking the backend. API keys are for usage identification and throttling, not user authentication. Private endpoints are not appropriate for a public mobile API, and relying only on client-side sign-in leaves the API without request-level authorization enforcement.
What this tests: Secrets Manager versus hard-coded configuration
A Lambda function needs database credentials that rotate regularly. Which implementation best follows AWS developer security guidance?
Best answer: B
Explanation: Secrets Manager is designed for managed secret storage and rotation. The Lambda execution role should have permission only to the required secret. Hard-coding or broadly granting secret access undermines rotation and least privilege.
What this tests: DynamoDB conditional writes
An order service must prevent two concurrent requests from reserving the same limited inventory item. Which DynamoDB feature should the developer use?
Best answer: C
Explanation: Conditional writes let DynamoDB update an item only when a required condition is true, such as available quantity being greater than zero. This avoids race conditions in concurrent requests. Indexes help query patterns, not concurrency control, and read-then-write patterns can still race without a condition.
What this tests: Deployment rollback strategy
A team deploys a new Lambda version behind an alias and wants to shift traffic gradually while monitoring errors. Which service feature best supports this?
Best answer: D
Explanation: CodeDeploy can shift traffic between Lambda versions through aliases using linear or canary deployments and can roll back when alarms fail. Reserved concurrency controls capacity, not release progression. Drift detection and scheduled events do not provide progressive deployment control.
What this tests: Observability and distributed tracing
A serverless API has intermittent latency. CloudWatch metrics show increased duration, but the team needs to see which downstream calls are slow across request paths. What should the developer enable?
Best answer: A
Explanation: X-Ray helps trace requests across supported services and identify slow downstream segments. CloudWatch metrics are useful but may not show where latency occurs inside a distributed path. Access logs, IAM analysis, and SQS polling do not answer this tracing question.
What this tests: SQS visibility timeout and duplicate processing
A Lambda function processes messages from SQS. Some messages are processed twice when work takes longer than expected. What is the most likely fix?
Best answer: B
Explanation: If processing exceeds the visibility timeout, the message can become visible again and be picked up a second time. The visibility timeout should cover expected processing time, with idempotent logic still used as a defensive design. Retention, message size, and disabled error handling do not solve the core timing issue.
What this tests: S3 presigned URL use case
A web application lets authenticated users upload large files directly to S3 without sending the file through the application server. Which approach is most appropriate?
Best answer: D
Explanation: Presigned URLs let the backend authorize a specific, time-limited S3 operation while keeping AWS credentials off the client. Public buckets and embedded keys are insecure. Proxying every large upload through the backend may work but is less efficient and not necessary for this pattern.
What this tests: EventBridge routing
Several microservices publish business events, and only selected consumers should receive events matching specific attributes. Which AWS service is the best fit for routing these events?
Best answer: C
Explanation: EventBridge is designed for event bus routing based on event patterns. Consumers can subscribe to the events they need without tight coupling to producers. EFS, Parameter Store, and CloudFront cookies serve unrelated purposes.
What this tests: Parameter Store and configuration management
A developer needs to store non-secret configuration values that vary by environment, such as feature flags and endpoint names. The values should be read by Lambda at runtime. Which option is usually the cleanest fit?
Best answer: A
Explanation: Parameter Store is a good fit for centrally managed application configuration, especially when values differ by environment. Hard-coded values make deployments brittle, while spreadsheets and public objects are not controlled runtime configuration mechanisms.
What this tests: Idempotency in event-driven applications
A payment-processing Lambda function may receive the same event more than once because of retry behavior. What should the developer do?
Best answer: B
Explanation: Event-driven AWS services commonly provide at-least-once delivery, so applications should tolerate duplicate events. Idempotency can be implemented with a unique request key, conditional writes, or a processed-event record. Disabling retries can lose work, and networking changes do not address duplicate processing.
flowchart LR
A["Application requirement"] --> B["Service integration"]
B --> C["Identity and permissions"]
C --> D["Error handling and scaling"]
D --> E["Observability"]
E --> F["Deployment and release"]
Use this map when a Developer Associate question describes an application workflow. Strong answers choose the service integration pattern, permission model, retry behavior, and observability path that fit the application requirement.
| Topic | Strong answer pattern | Common trap |
|---|---|---|
| Serverless integration | Match Lambda, API Gateway, EventBridge, SQS, SNS, Step Functions, and DynamoDB to event flow | Forcing synchronous calls where decoupling is safer |
| IAM | Grant least-privilege roles to functions, services, and deployments | Using broad administrator permissions to fix access errors |
| Resilience | Use retries, DLQs, idempotency, timeouts, and backoff | Retrying non-idempotent operations without safeguards |
| Data access | Choose access pattern, partition key, consistency, and capacity mode | Designing DynamoDB tables like relational tables |
| Observability | Log correlation IDs, metrics, traces, and meaningful alarms | Logging only success messages |
| Deployment | Use versioning, aliases, staged releases, and rollback | Updating production code without a release path |
Use this page to review sample questions, request an update for this route, and compare related IT Mastery pages.
If you want concept-first reading before heavier simulator work, use the companion guide at TechExamLexicon.com .