68 Free DVA-C02 Questions To Ace AWS Developer Associate

The AWS Certified Developer – Associate (DVA-C02) certification validates your technical proficiency in developing, deploying, and debugging cloud-based applications using AWS services. The DVA-C02 exam is highly focused on serverless technologies, containerization, security best practices, and CI/CD pipelines. To secure this credential and prove your expertise, you must engage with a verified, high-quality, free AWS practice test. This comprehensive set of 68 DVA-C02 questions is the definitive resource for your final preparation.

Note: The full interactive practice test is available immediately at the bottom of this post.

68 Essential DVA-C02 Questions to Master AWS Development

Why High-Quality DVA-C02 Practice Is Your Competitive Edge

The DVA-C02 exam presents complex, scenario-based questions that require not just memorization, but a practical understanding of service integration and security architecture. Relying solely on unreliable AWS DVA-C02 exam dumps will result in critical gaps in your knowledge. Our free AWS practice tests are engineered by experts to reflect the depth and structure of the actual DVA-C02 exam, ensuring you gain the necessary competence to pass and thrive as a developer.

Serverless Security and Performance on the DVA-C02

Serverless technology, especially AWS Lambda, is a major component of the DVA-C02 curriculum, focusing on both performance optimization and secure configuration.

Secure Access for Lambda Functions

Adhering to security best practices for the DVA-C02 means eliminating long-term credentials. When a Lambda function needs to read data from a DynamoDB table, the function should be configured to use an IAM Execution Role. This role grants the function temporary, automatically rotated credentials, which is the most secure and recommended method for granting permissions to AWS compute services.

Mitigating the Cold Start Problem (A Key DVA-C02 Focus)

One challenge with Lambda is the “cold start,” where the first invocation after inactivity experiences high latency. For latency-sensitive applications, the DVA-C02 solution is Provisioned Concurrency. This feature keeps a specified number of function instances initialized and ready to respond immediately, effectively eliminating cold starts for those instances and ensuring consistent performance.

https://aws.amazon.com/serverless

Mastering AWS Messaging and Integration Services

A significant portion of the DVA-C02 exam covers asynchronous communication patterns, particularly using Amazon SQS (Simple Queue Service).

Preventing Message Duplication in SQS

A frequent problem tested on the DVA-C02 is message duplication under high load. When EC2 instances process messages from an SQS standard queue, the key setting to prevent a message from being processed by multiple consumers simultaneously is the Visibility Timeout. The timeout must be set to be longer than the maximum time it takes a consumer to process and delete the message. Setting the timeout too short risks the message becoming visible again before processing is complete, leading to duplication.

Handling Manual Approval in CI/CD Pipelines

For production deployments, adding a verification step is critical. AWS CodePipeline supports integrating manual intervention using the Manual Approval Action type. This action can be easily added to any stage of the pipeline (e.g., between Staging and Production) to pause execution until an authorized user explicitly approves or rejects the deployment, a necessary skill for the DVA-C02 developer.

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/welcome.html

Secure Development and Credential Management for the DVA-C02

The DVA-C02 requires expertise in handling sensitive application data and automating credential rotation.

Automating Secret Rotation with a Managed Service

Storing sensitive database credentials directly in application code or configuration files is a security failure. When an application running on an EC2 instance needs credentials that must be automatically rotated every 30 days, the solution is AWS Secrets Manager. Secrets Manager is purpose-built to store, retrieve, and automatically rotate credentials and API keys, providing integration with services like RDS. This service is a core security component tested on the DVA-C02.

Securing Public Access to Data

When dealing with static assets in Amazon S3, ensuring that content is served securely via CloudFront but cannot be accessed directly via the S3 URL requires using an Origin Access Control (OAC) or, for older configurations, an Origin Access Identity (OAI). The DVA-C02 focuses on configuring the CloudFront distribution to restrict direct S3 bucket access, forcing all traffic through the secure CDN endpoint.

Conclusion

Passing the AWS DVA-C02 certification confirms your status as a competent cloud developer. Your success depends on moving beyond theoretical knowledge and demonstrating practical understanding of AWS services in scenario-based challenges. This free AWS DVA-C02 practice test offers 68 expert questions and authoritative explanations to ensure you master every domain. Avoid the low confidence that comes from using unreliable AWS DVA-C02 exam dumps. Please do not forget to checkout other free Amazon Web Services Certifications on CertyBuddy.com: https://certybuddy.com/practice-tests/?vendor=aws

Take the professional step now. Master the core development services and pass the DVA-C02 exam on your first attempt!

/136

68 Essential DVA-C02 Questions to Master AWS Development

Which AWS service is specifically designed to be a registry for container images?

1 / 136

A developer wants to package a Lambda function as a container image to include a large machine learning model. Where should the container image be stored so that Lambda can access it?

Amazon EBS.

Amazon Elastic Container Registry (ECR).

Amazon S3.

Docker Hub.

Remember the order of precedence in IAM policy evaluation, specifically how ‘Deny’ is treated.

2 / 136

A developer is creating a policy for an IAM role. The policy must allow all actions on EC2 (`ec2:*`) but explicitly forbid terminating instances (`ec2:TerminateInstances`). How should the IAM policy be structured?

Create a single policy statement with `Effect: "Allow"` and list all EC2 actions except `ec2:TerminateInstances` in the `Action` element.

Create one policy statement with `Effect: "Allow"`, `Action: "ec2:*"` and a second, separate statement with `Effect: "Deny"`, `Action: "ec2:TerminateInstances"`.

Create one policy statement with `Effect: "Allow"`, `Action: "ec2:*"` and another statement with `Effect: "Allow"`, `Action: "ec2:TerminateInstances"`.

This is not possible; a policy cannot both allow a wildcard and deny a specific action within that wildcard.

Think of a ‘development kit’ that lets you write infrastructure definitions as if you were writing a regular software application.

3 / 136

A developer needs to programmatically create, update, and delete AWS infrastructure using a familiar programming language like Python or TypeScript instead of writing YAML/JSON templates. Which AWS Infrastructure as Code (IaC) tool should be used?

AWS Serverless Application Model (SAM).

AWS Cloud Development Kit (CDK).

AWS Elastic Beanstalk CLI.

AWS CloudFormation.

Consider the initialization phase of a serverless function and how to keep instances ‘warm’.

4 / 136

A Lambda function is experiencing high latency during its first invocation after a period of inactivity. Subsequent invocations are much faster. What is this phenomenon called, and what is a common strategy to mitigate it for latency-sensitive applications?

This is a 'cold start', and it can be mitigated by increasing the function's memory.

This is a 'cold start', and it can be mitigated by configuring Provisioned Concurrency.

This is a 'concurrency limit', and it can be mitigated by requesting a service quota increase.

This is a 'timeout error', and it can be mitigated by increasing the function's timeout setting.

Consider the size limits for different Lambda deployment methods.

5 / 136

A developer needs to package a Lambda function and its dependencies. The total size of the deployment package is over 50 MB, but less than 250 MB. How should the developer deploy this function?

Upload the function as a .zip file directly to the Lambda console.

Package the function and its dependencies into a .zip file, upload it to an S3 bucket, and then specify the S3 object location when creating the Lambda function.

The function cannot be deployed because it exceeds the maximum size limit.

Use the inline code editor in the Lambda console.

Look for a service designed to provide identity solutions for your customer-facing applications.

6 / 136

A web application requires user sign-up, sign-in, and management of user profiles. The developer wants to offload this functionality to a managed service that also supports federation with social identity providers like Google and Facebook. Which AWS service should be used?

AWS Identity and Access Management (IAM).

AWS Single Sign-On (SSO).

Amazon Cognito.

AWS Directory Service.

Which launch type provides a ‘serverless’ experience for running containers?

7 / 136

When deploying a containerized application to Amazon ECS, the developer wants AWS to manage the underlying EC2 instances, including patching and scaling. The developer only wants to define the task (container definitions, CPU, memory). What ECS launch type should be used?

External launch type.

EC2 launch type.

Fargate launch type.

Spot launch type.

This strategy is named after the ‘canary in a coal mine’ analogy, used to detect problems early.

8 / 136

A developer needs to deploy a new version of a Lambda function with minimal risk. The strategy should involve directing a small percentage of production traffic (e.g., 10%) to the new version first. If it performs well, traffic can be gradually increased. What deployment strategy does this describe?

Blue/Green deployment.

Rolling deployment.

All-at-once deployment.

Canary deployment.

Look for a Platform as a Service (PaaS) offering that simplifies web application deployment.

9 / 136

A developer needs to deploy a Dockerized web application to AWS. The service should automatically handle load balancing, auto scaling, and application health monitoring with minimal configuration. The developer wants a simple, PaaS-like experience. Which service is the best fit?

Amazon EC2.

AWS Lambda with container image support.

AWS Elastic Beanstalk.

Amazon ECS with Fargate.

Consider CloudFormation’s default behavior for maintaining stack integrity when an operation goes wrong.

10 / 136

A CloudFormation stack update fails. By default, what is the state of the stack after the failure?

The stack is deleted.

The stack remains in the partially updated, failed state (`UPDATE_FAILED`).

The stack enters a `UPDATE_IN_PROGRESS` state indefinitely until manually fixed.

The stack is automatically rolled back to its previous working state (`UPDATE_ROLLBACK_COMPLETE`).

Think about what information the server needs to hold (or not hold) between user interactions.

11 / 136

Which of the following is a key characteristic of a ‘stateless’ application?

It is difficult to scale horizontally.

Each request from a client contains all the information needed to be understood and processed by the server.

It requires sticky sessions on the load balancer to function correctly.

It stores session data on the local disk of the server processing the request.

Think about how to simulate the behavior of an external service within your local test environment.

12 / 136

A developer is writing unit tests for a Lambda function that interacts with S3. To avoid making actual API calls to S3 during the tests, what is a common practice?

Run the tests only on an EC2 instance that has an IAM role with S3 permissions.

Temporarily disable the S3 service in the AWS account during the test run.

Use a mocking library (like `moto` for Python or `aws-sdk-mock` for Node.js) to simulate the AWS SDK's S3 client and its responses.

Create a dedicated 'test' S3 bucket and clean it up after each test run.

Consider the hierarchy of IAM policy evaluation. Which effect is final?

13 / 136

What does an explicit `Deny` in an IAM policy statement do?

It only applies if no `Allow` statement for the action is found.

It can be overridden by an `Allow` statement in another policy attached to the same principal.

It overrides any `Allow` statements, preventing the action regardless of other policies.

It has no effect if there is an `Allow` for the same action.

Consider how DynamoDB uses the partition key to distribute data and workload across its underlying storage.

14 / 136

When configuring a DynamoDB table, a developer chooses a partition key with low cardinality (e.g., a ‘status’ field with only three possible values: ‘pending’, ‘complete’, ‘failed’). What is the likely performance consequence of this design?

It will cause write operations to fail but will not affect read operations.

It will lead to a 'hot partition' problem, where read/write traffic is concentrated on a few partitions, causing throttling.

It will improve read performance because fewer partitions need to be scanned.

It has no impact on performance, as DynamoDB automatically re-distributes data.

Consider the order of operations in a DynamoDB query: when is the filter applied relative to the data being read from storage?

15 / 136

An application is reading data from a DynamoDB global secondary index (GSI). The query is using a filter expression, but the developer notices that this is consuming a large number of read capacity units (RCUs), even for queries that return few items. What is the reason for this high RCU consumption?

DynamoDB applies the filter expression after reading the data that matches the key condition, so RCUs are consumed for all read items, not just the filtered results.

The GSI is not provisioned with enough write capacity.

Using a filter expression requires strongly consistent reads, which consume more RCUs.

Filter expressions are not supported on GSIs.

Think about the AWS mechanism for granting temporary, secure permissions to services without using long-term credentials.

16 / 136

A developer is building a serverless application where a Lambda function needs to read data from a DynamoDB table. To adhere to security best practices, how should the Lambda function be configured to access the DynamoDB table?

Configure a resource-based policy on the DynamoDB table that allows anonymous public read access.

Create an IAM role with a policy granting DynamoDB read permissions and assign this role as the function's execution role.

Create an IAM user with DynamoDB read permissions and store the access keys as environment variables in the Lambda function.

Hardcode the root user's access keys directly into the Lambda function's code for direct access.

A template must define something to be created. Which section serves this fundamental purpose?

17 / 136

Which section of an AWS CloudFormation template is mandatory?

Outputs

Parameters

Mappings

Resources

Consider the initialization phase of a serverless function and how to keep instances ‘warm’.

18 / 136

This is a 'concurrency limit', and it can be mitigated by requesting a service quota increase.

This is a 'cold start', and it can be mitigated by increasing the function's memory.

This is a 'timeout error', and it can be mitigated by increasing the function's timeout setting.

This is a 'cold start', and it can be mitigated by configuring Provisioned Concurrency.

Look for a framework that acts as a transform on top of CloudFormation to simplify serverless definitions.

19 / 136

A developer wants to model and provision a serverless application consisting of Lambda functions, an API Gateway, and a DynamoDB table using infrastructure as code. They prefer a simplified, declarative syntax focused on serverless resources. Which AWS service or framework is most appropriate?

AWS CDK (Cloud Development Kit).

AWS Elastic Beanstalk.

AWS Serverless Application Model (SAM).

AWS CloudFormation.

This strategy is named after the ‘canary in a coal mine’ analogy, used to detect problems early.

20 / 136

All-at-once deployment.

Canary deployment.

Rolling deployment.

Blue/Green deployment.

Think about how to scale a database horizontally for read operations.

21 / 136

To improve the read performance of a high-traffic, read-heavy RDS for PostgreSQL database, what is the MOST effective strategy?

Increase the size of the database instance (vertical scaling).

Enable Multi-AZ deployment.

Create one or more Read Replicas and direct read queries to them.

Take more frequent database snapshots.

Consider API Gateway’s ability to act as a proxy directly to the APIs of other AWS services.

22 / 136

A developer needs to create a REST API endpoint that returns a list of items from a DynamoDB table. The integration should be as fast as possible, without invoking a Lambda function for this simple read operation. How can this be achieved in API Gateway?

Use a Lambda proxy integration.

This is not possible; a Lambda function is always required for API Gateway to interact with DynamoDB.

Use an HTTP proxy integration to a public DynamoDB endpoint.

Use an AWS service integration (or non-proxy integration) that calls the DynamoDB `Scan` or `Query` API action directly.

Think about the configuration files the AWS CLI uses to store credentials and settings.

23 / 136

A developer is using the AWS CLI and needs to work with multiple AWS accounts. What is the recommended way to configure the CLI to easily switch between accounts without repeatedly entering credentials?

Run `aws configure` each time to switch accounts.

Set environment variables for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

Configure named profiles in the `~/.aws/credentials` and `~/.aws/config` files and use the `–profile` flag.

Create a separate EC2 instance for each AWS account and install the AWS CLI on each.

Which template section acts like a dictionary or a lookup table?

24 / 136

A developer is creating a CloudFormation template and needs to set the EC2 instance type based on the environment (e.g., ‘t2.micro’ for dev, ‘m5.large’ for prod) that is specified as an input parameter. Which section of the template should be used to define this mapping?

Resources

Parameters

Conditions

Mappings

Think about the AWS mechanism for granting temporary, secure permissions to services without using long-term credentials.

25 / 136

Create an IAM role with a policy granting DynamoDB read permissions and assign this role as the function's execution role.

Hardcode the root user's access keys directly into the Lambda function's code for direct access.

Configure a resource-based policy on the DynamoDB table that allows anonymous public read access.

Create an IAM user with DynamoDB read permissions and store the access keys as environment variables in the Lambda function.

Consider a concurrency control pattern that checks if the data has changed since it was read.

26 / 136

A developer needs to ensure that write operations to a DynamoDB table do not overwrite updates made by another process. For example, if two users try to update an item’s quantity at the same time, the final result should reflect both changes correctly. What is the recommended strategy for this?

Increase the Write Capacity Units (WCUs) for the table.

Use eventually consistent reads.

Implement optimistic locking with a version number attribute and a condition expression.

Enable DynamoDB transactions.

The word ‘guided’ suggests an interactive or step-by-step process.

27 / 136

What is the purpose of the `sam deploy –guided` command in the AWS SAM CLI?

It validates the SAM template for syntax errors but does not deploy it.

It initiates an interactive deployment process, prompting the user for parameters like stack name, region, and deployment confirmation.

It deploys the application locally in a Docker container for testing.

It deploys the application without building it first.

Think about the configuration files the AWS CLI uses to store credentials and settings.

28 / 136

Create a separate EC2 instance for each AWS account and install the AWS CLI on each.

Configure named profiles in the `~/.aws/credentials` and `~/.aws/config` files and use the `–profile` flag.

Set environment variables for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

Run `aws configure` each time to switch accounts.

Which service uses ‘topics’ and ‘subscriptions’ as its core concepts?

29 / 136

An application needs to publish messages to a large number of subscribers. Some subscribers are SQS queues, some are Lambda functions, and some are external HTTP endpoints. The application should not need to know the details of each subscriber. Which service facilitates this pub/sub messaging pattern?

Amazon SQS.

Amazon SNS (Simple Notification Service).

Amazon Kinesis Data Streams.

Amazon MQ.

A 403 error almost always relates to permissions. What permissions are needed for a public website?

30 / 136

An S3 bucket is configured to host a static website. When users try to access the website using the S3 website endpoint URL, they receive a 403 Forbidden error. The objects in the bucket are not publicly accessible. What is the most likely cause and solution?

The S3 bucket name is not globally unique. The bucket must be recreated with a unique name.

The region's S3 endpoint is down. The user should wait for the service to be restored.

Cross-Origin Resource Sharing (CORS) is not configured on the bucket.

A bucket policy that allows public read access (`s3:GetObject`) for all objects in the bucket is missing.

A template must define something to be created. Which section serves this fundamental purpose?

31 / 136

Which section of an AWS CloudFormation template is mandatory?

Mappings

Outputs

Resources

Parameters

Consider how DynamoDB uses the partition key to distribute data and workload across its underlying storage.

32 / 136

It will improve read performance because fewer partitions need to be scanned.

It has no impact on performance, as DynamoDB automatically re-distributes data.

It will cause write operations to fail but will not affect read operations.

It will lead to a 'hot partition' problem, where read/write traffic is concentrated on a few partitions, causing throttling.

Look for a service specifically designed for managing the lifecycle of sensitive information like passwords and API keys.

33 / 136

A developer needs to store sensitive database credentials that an application on an EC2 instance will use. The credentials must be rotated automatically every 30 days. Which AWS service is best suited for this requirement?

Use IAM instance profile roles.

AWS Systems Manager Parameter Store using a Standard parameter.

AWS Secrets Manager.

Store the credentials in an encrypted S3 bucket with a lifecycle policy.

Which service is designed for ‘object storage’ and is effectively unlimited in scale?

34 / 136

An application needs to store and retrieve large objects (e.g., videos and images) up to several gigabytes in size. The objects must be highly durable and available. Which storage service is the most appropriate choice?

Amazon S3 (Simple Storage Service).

Amazon ElastiCache.

Amazon DynamoDB.

Amazon EBS (Elastic Block Store).

Look for an encryption option in the settings of the CloudWatch Logs resource itself.

35 / 136

A Lambda function processes sensitive data and must write its logs to CloudWatch Logs. How can a developer ensure that the log data is protected at rest in CloudWatch Logs?

Manually encrypt the log message strings within the Lambda function code before logging.

Store the logs in an encrypted S3 bucket instead of CloudWatch Logs.

CloudWatch Logs are encrypted by default and no action is needed.

Enable server-side encryption for the CloudWatch log group using AWS KMS.

Consider a concurrency control pattern that checks if the data has changed since it was read.

36 / 136

Enable DynamoDB transactions.

Implement optimistic locking with a version number attribute and a condition expression.

Increase the Write Capacity Units (WCUs) for the table.

Use eventually consistent reads.

Think about the part of the URL that identifies the specific website or service being requested.

37 / 136

A developer needs to configure an Application Load Balancer (ALB) to route traffic to different target groups based on the hostname in the request (e.g., `api.example.com` goes to one group, `www.example.com` goes to another). What feature of the ALB listener should be used?

Query string-based routing.

Host-based routing.

Path-based routing.

Source IP-based routing.

Consider the order of operations in a DynamoDB query: when is the filter applied relative to the data being read from storage?

38 / 136

Using a filter expression requires strongly consistent reads, which consume more RCUs.

Filter expressions are not supported on GSIs.

The GSI is not provisioned with enough write capacity.

DynamoDB applies the filter expression after reading the data that matches the key condition, so RCUs are consumed for all read items, not just the filtered results.

Consider the authentication mechanisms provided by IAM for services that integrate with standard protocols like Git.

39 / 136

A developer is using AWS CodeCommit as a source repository. Which of the following is a valid method for authenticating Git commands from a local development machine?

Using the AWS account root user password.

Using a personal access token generated from GitHub.

Using an EC2 instance profile role from the local machine.

Using HTTPS with the AWS CLI credential helper or by generating Git credentials in the IAM console.

Think about how the server can identify and disregard duplicate requests from a client.

40 / 136

A developer wants to ensure that an API endpoint is idempotent, meaning that making the same POST request multiple times has the same effect as making it once. What is a common technique to implement idempotency in an API design?

Use the HTTP GET method for all create operations.

Require the client to generate and pass a unique idempotency key in the request header or body.

Decrease the API Gateway timeout to prevent long-running requests.

Rely on the client to never send a duplicate request.

Which AWS service is specifically designed to be a registry for container images?

41 / 136

A developer wants to package a Lambda function as a container image to include a large machine learning model. Where should the container image be stored so that Lambda can access it?

Amazon S3.

Amazon EBS.

Amazon Elastic Container Registry (ECR).

Docker Hub.

Consider how a software application programmatically interacts with external services.

42 / 136

What is the function of the AWS SDK in application development?

To define AWS infrastructure as code using YAML or JSON templates.

To provide a web-based console for visually interacting with AWS services.

To provide a command-line interface for managing AWS resources.

To provide language-specific APIs for calling AWS services from within your application code.

The word ‘guided’ suggests an interactive or step-by-step process.

43 / 136

What is the purpose of the `sam deploy –guided` command in the AWS SAM CLI?

It validates the SAM template for syntax errors but does not deploy it.

It initiates an interactive deployment process, prompting the user for parameters like stack name, region, and deployment confirmation.

It deploys the application without building it first.

It deploys the application locally in a Docker container for testing.

Consider the size limits for different Lambda deployment methods.

44 / 136

A developer needs to package a Lambda function and its dependencies. The total size of the deployment package is over 50 MB, but less than 250 MB. How should the developer deploy this function?

Use the inline code editor in the Lambda console.

Upload the function as a .zip file directly to the Lambda console.

The function cannot be deployed because it exceeds the maximum size limit.

Package the function and its dependencies into a .zip file, upload it to an S3 bucket, and then specify the S3 object location when creating the Lambda function.

Think about the part of the URL that identifies the specific website or service being requested.

45 / 136

Source IP-based routing.

Path-based routing.

Host-based routing.

Query string-based routing.

Which service uses ‘topics’ and ‘subscriptions’ as its core concepts?

46 / 136

Amazon SQS.

Amazon MQ.

Amazon SNS (Simple Notification Service).

Amazon Kinesis Data Streams.

Look for a service that allows you to define a workflow as a ‘state machine’.

47 / 136

An application is being refactored from a monolith to a microservices architecture. The developer needs a service to orchestrate a complex, multi-step workflow that involves several Lambda functions, some of which may run for a long time. The workflow requires error handling, retries, and parallel execution branches. Which AWS service is best suited for this?

Amazon Kinesis Data Streams.

AWS Step Functions.

Amazon SNS.

Amazon SQS.

Look for the STS operation that explicitly mentions the required federation protocol.

48 / 136

A developer needs to provide an application running on-premises with temporary, limited-privilege access to an S3 bucket. The company uses an identity provider that supports SAML 2.0. Which AWS STS API call should be used to get temporary AWS credentials?

`GetSessionToken`

`AssumeRoleWithSAML`

`AssumeRole`

`GetFederationToken`

A 403 error almost always relates to permissions. What permissions are needed for a public website?

49 / 136

The S3 bucket name is not globally unique. The bucket must be recreated with a unique name.

The region's S3 endpoint is down. The user should wait for the service to be restored.

Cross-Origin Resource Sharing (CORS) is not configured on the bucket.

A bucket policy that allows public read access (`s3:GetObject`) for all objects in the bucket is missing.

Check the available action types within a CodePipeline stage for a feature that pauses execution.

50 / 136

A team is using AWS CodePipeline to automate their release process. They need to add a stage where a manager must manually approve the deployment before it proceeds to the production environment. How can this be achieved in CodePipeline?

Add a manual approval action to a new stage in the pipeline.

Trigger a Lambda function that sends an email and waits for a reply before completing.

Configure an AWS Step Functions state machine with a wait state and integrate it with the pipeline.

Use a CodeBuild action that pauses until a manual input is received.

Look for a feature within the S3 service settings for sending notifications about bucket events.

51 / 136

A Lambda function needs to be triggered whenever a new object is created in a specific S3 bucket. How should this be configured?

Configure the Lambda function to poll the S3 bucket every second.

Set up an S3 event notification to trigger the Lambda function.

Use a CloudWatch Event (or EventBridge) rule that monitors S3 API calls via CloudTrail.

Deploy a Kinesis Data Firehose delivery stream to send S3 objects to the Lambda function.

Think about how a single broadcast message can be delivered to multiple independent listeners.

52 / 136

An application is designed using an event-driven architecture. A single event from an SNS topic needs to be processed independently and in parallel by multiple downstream services (SQS queues, Lambda functions, etc.). Which architectural pattern should be implemented?

Circuit breaker pattern.

Fan-out pattern.

Fan-in pattern.

Dead-Letter Queue (DLQ) pattern.

Consider the endpoint type that requires a VPC endpoint for access.

53 / 136

An API Gateway REST API must be accessible only from within a specific VPC. No traffic from the public internet should be able to reach the API. What type of API endpoint should be configured?

Regional

Private

Edge-optimized

Public

Consider the authentication mechanisms provided by IAM for services that integrate with standard protocols like Git.

54 / 136

A developer is using AWS CodeCommit as a source repository. Which of the following is a valid method for authenticating Git commands from a local development machine?

Using the AWS account root user password.

Using HTTPS with the AWS CLI credential helper or by generating Git credentials in the IAM console.

Using an EC2 instance profile role from the local machine.

Using a personal access token generated from GitHub.

Think about the mechanism Lambda provides for sharing code and dependencies across multiple functions.

55 / 136

A Lambda function written in Python needs to use an external library that is not included in the AWS SDK. How should this dependency be included in the Lambda deployment package?

The function code must be rewritten to not use any external libraries.

Use a Lambda Layer to package the library separately from the function code.

The library must be installed globally in the AWS Lambda runtime environment by submitting a support ticket.

Store the library in an S3 bucket and have the Lambda function download and install it during initialization.

Consider how permissions can be dynamically managed for running EC2 instances without service interruption.

56 / 136

A developer needs to give an EC2 instance permission to call the S3 `GetObject` API. The EC2 instance is already running. What is the most secure and efficient way to grant these permissions?

Stop the EC2 instance, create an IAM role with the required S3 permissions, attach the role to the instance, and restart it.

Create an IAM role with the required S3 permissions and use the `attach-role-to-instance` CLI command to apply it to the running instance.

Modify the S3 bucket policy to allow access from the EC2 instance's public IP address.

Create an IAM user, generate access keys, and store them in a configuration file on the EC2 instance.

Consider the unit of parallelism in a Kinesis Data Stream.

57 / 136

An application writes data to a Kinesis Data Stream. A Lambda function is configured to process records from this stream. Under heavy load, the Lambda function is getting throttled and cannot keep up with the incoming data. What is the most direct way to increase the processing capacity of the Kinesis-Lambda integration?

Increase the number of shards in the Kinesis Data Stream.

Increase the memory of the Lambda function.

Switch from Kinesis Data Streams to Kinesis Data Firehose.

Decrease the batch size of the Lambda function.

Think of this file as the ‘specification’ for the ‘build’ process.

58 / 136

What is the primary purpose of a `buildspec.yml` file in an AWS CodeBuild project?

To define the manual approval steps required before deployment.

To configure the source code repository and branch that will trigger the build.

To specify the build commands to run, the runtime environment to use, and the output artifacts to generate.

To define the infrastructure resources needed for the build, such as VPCs and subnets.

Follow the principle of using IAM roles to grant permissions to AWS services.

59 / 136

During a CI/CD pipeline run with CodeBuild, the build process needs access to a password stored in AWS Secrets Manager. What is the recommended way to provide this access?

Pass the secret to the build using the `aws codebuild start-build` command's `–environment-variables-override` flag.

Create an IAM user, store its access keys in the `buildspec.yml`, and use them to retrieve the secret.

Grant the CodeBuild service role IAM permissions to read the secret from Secrets Manager.

Hardcode the password as a plain text environment variable in the `buildspec.yml` file.

The term ‘stateless’ implies that the compute layer itself does not hold state. Where must the state go instead?

60 / 136

A developer is building a stateless REST API using API Gateway and Lambda. Where should the application’s session state (e.g., user login status, shopping cart contents) be stored?

In a stateful data store like Amazon DynamoDB or ElastiCache.

In API Gateway's cache.

On the local filesystem (`/tmp` directory) of the Lambda execution environment.

In global variables within the Lambda function.

Look for a service that allows you to define a workflow as a ‘state machine’.

61 / 136

Amazon Kinesis Data Streams.

Amazon SNS.

AWS Step Functions.

Amazon SQS.

Consider the CloudWatch feature that lets you perform calculations on existing metrics.

62 / 136

A developer needs to configure a CloudWatch alarm that triggers when a Lambda function’s error rate exceeds 5% over a 10-minute period. However, the standard `Errors` and `Invocations` metrics are not sufficient to create this specific alarm directly. What feature of CloudWatch can be used to create the required alarm?

CloudWatch Logs Insights.

Metric Math.

Embedded Metric Format (EMF).

CloudWatch Dashboards.

The term ‘stateless’ implies that the compute layer itself does not hold state. Where must the state go instead?

63 / 136

A developer is building a stateless REST API using API Gateway and Lambda. Where should the application’s session state (e.g., user login status, shopping cart contents) be stored?

In a stateful data store like Amazon DynamoDB or ElastiCache.

In API Gateway's cache.

On the local filesystem (`/tmp` directory) of the Lambda execution environment.

In global variables within the Lambda function.

Consider the default safety mechanism of a deployment service when an error is encountered.

64 / 136

A developer is using AWS CodeDeploy to deploy an application to a fleet of EC2 instances. The deployment fails on a few instances. By default, what will CodeDeploy do?

Immediately roll back the entire deployment on all instances to the last known good version.

Continue the deployment to all other instances and report the failures at the end.

Stop the entire deployment and mark the overall deployment status as 'Failed'.

Automatically terminate the failed instances and let the Auto Scaling group replace them.

Think of a service that acts as a central ‘bus’ for events from many different sources.

65 / 136

What is a primary use case for Amazon EventBridge?

To orchestrate complex, multi-step workflows with visual state machines.

To create a fully managed message queue for decoupling microservices.

To provide real-time, bidirectional communication for web applications.

To build a serverless event bus that connects applications with data from various sources, including AWS services, SaaS applications, and custom applications.

Look for a service designed to provide identity solutions for your customer-facing applications.

66 / 136

AWS Single Sign-On (SSO).

AWS Identity and Access Management (IAM).

Amazon Cognito.

AWS Directory Service.

How can you break down the timing information within a single trace segment?

67 / 136

An X-Ray service map shows that a downstream microservice is a significant bottleneck, with high latency. The developer wants to capture more detailed timing information about the specific database queries being made within that service. What should be added to the service’s code?

Subsegments

Annotations

Metadata

A new segment

Which service is dedicated to managing certificates for AWS endpoints?

68 / 136

A developer needs to configure a custom domain name for an API deployed with API Gateway. The API also needs to be secured with an SSL/TLS certificate. Which service should be used to provide and manage the certificate?

AWS Certificate Manager (ACM).

AWS Secrets Manager.

AWS Key Management Service (KMS).

AWS IAM Server Certificates.

Look for a Platform as a Service (PaaS) offering that simplifies web application deployment.

69 / 136

Amazon ECS with Fargate.

AWS Lambda with container image support.

AWS Elastic Beanstalk.

Amazon EC2.

Look for a service specifically designed for managing the lifecycle of sensitive information like passwords and API keys.

70 / 136

AWS Secrets Manager.

Use IAM instance profile roles.

AWS Systems Manager Parameter Store using a Standard parameter.

Store the credentials in an encrypted S3 bucket with a lifecycle policy.

Think about the intermediate artifact that the CDK generates before deployment.

71 / 136

A developer is using the AWS CDK to define their infrastructure. What is the purpose of the `cdk synth` command?

It deploys the infrastructure directly to the AWS account.

It compares the current stack with the CDK code and shows a diff.

It synthesizes the CDK code into a CloudFormation template.

It destroys all resources in the deployed stack.

Look for a standard AWS CLI parameter that uses a specific query language for JSON.

72 / 136

A developer needs to use the AWS CLI to get details about a specific EC2 instance, but only wants to see the `InstanceId`, `InstanceType`, and `State`. How can the output be filtered on the client side to show only these fields?

Use the `–filter` parameter.

Pipe the output to a command-line tool like `grep` or `awk`.

Use the `–output text` parameter.

Use the `–query` parameter with a JMESPath expression.

Think about the mechanism Lambda provides for sharing code and dependencies across multiple functions.

73 / 136

A Lambda function written in Python needs to use an external library that is not included in the AWS SDK. How should this dependency be included in the Lambda deployment package?

The library must be installed globally in the AWS Lambda runtime environment by submitting a support ticket.

The function code must be rewritten to not use any external libraries.

Store the library in an S3 bucket and have the Lambda function download and install it during initialization.

Use a Lambda Layer to package the library separately from the function code.

Think of a deployment strategy that involves two identical, parallel production environments.

74 / 136

An application deployed using AWS Elastic Beanstalk needs to be updated. The developer wants to ensure zero downtime during the update and wants to have a new, fully functional environment running alongside the old one for a period of time to allow for testing before switching traffic. Which Elastic Beanstalk deployment method is most suitable?

Rolling with additional batch.

Rolling.

Blue/Green.

All at once.

Which mechanism is designed to isolate messages that repeatedly fail processing?

75 / 136

A Lambda function is configured to process messages from an SQS queue. Some messages contain invalid data that causes the function to fail and throw an exception. These ‘poison pill’ messages are repeatedly retried, blocking other valid messages. What should be configured to handle these failed messages?

Use a try/catch block in the Lambda function to ignore the errors.

Configure Lambda Destinations for `on-failure` events.

Configure a Dead-Letter Queue (DLQ) on the SQS queue's redrive policy.

Increase the function's memory and timeout.

Consider the structure of a REST API, which involves resources and the actions (methods) you can perform on them.

76 / 136

A REST API built with API Gateway and Lambda needs to handle different business logic based on the HTTP method (GET, POST, DELETE) for the same resource path (e.g., `/items`). How should this be configured in API Gateway?

Use query string parameters to specify the intended action (e.g., `/items?action=delete`).

Create a separate API Gateway for each HTTP method.

Create a single resource (e.g., `/items`) and define a separate method (GET, POST, DELETE) under that resource, each integrated with a specific Lambda function or a single function that handles routing.

Create a single Lambda function and use a large `if/else` block to check the `event.httpMethod`.

Consider the lifecycle of a message in an SQS queue and how consumers interact with it.

77 / 136

An application running on EC2 instances processes messages from an SQS standard queue. During periods of high load, some messages are processed more than once, causing data duplication. What is the most effective way to prevent this issue while maintaining high throughput?

Decrease the visibility timeout to force faster message processing.

Implement long polling on the SQS queue.

Switch to an SQS FIFO queue.

Increase the visibility timeout to a value longer than the processing time and ensure the application deletes the message after successful processing.

Think of a service that is part of a broader management suite and designed for storing ‘parameters’.

78 / 136

A developer needs to store application configuration data, including database connection strings and feature flags, in a centralized location. Some of this data is sensitive. The application should be able to retrieve this configuration dynamically. Which service provides a simple key-value store suitable for both plain-text and encrypted configuration data?

AWS AppConfig.

AWS Systems Manager Parameter Store.

Amazon S3.

Amazon DynamoDB.

Think about how to simulate the behavior of an external service within your local test environment.

79 / 136

A developer is writing unit tests for a Lambda function that interacts with S3. To avoid making actual API calls to S3 during the tests, what is a common practice?

Use a mocking library (like `moto` for Python or `aws-sdk-mock` for Node.js) to simulate the AWS SDK's S3 client and its responses.

Temporarily disable the S3 service in the AWS account during the test run.

Run the tests only on an EC2 instance that has an IAM role with S3 permissions.

Create a dedicated 'test' S3 bucket and clean it up after each test run.

Compare the feature sets of the two main open-source caching engines supported by ElastiCache.

80 / 136

An application needs to cache frequently accessed data from a database to reduce latency and database load. The caching solution must support advanced data structures like sorted sets and lists, and offer replication for high availability. Which ElastiCache engine should be chosen?

Redis.

DynamoDB Accelerator (DAX).

Memcached.

MySQL.

Think of this file as the ‘specification’ for the ‘build’ process.

81 / 136

What is the primary purpose of a `buildspec.yml` file in an AWS CodeBuild project?

To specify the build commands to run, the runtime environment to use, and the output artifacts to generate.

To define the infrastructure resources needed for the build, such as VPCs and subnets.

To configure the source code repository and branch that will trigger the build.

To define the manual approval steps required before deployment.

Look for the service in the AWS ‘Code’ suite that is analogous to GitHub or Bitbucket.

82 / 136

Which AWS service is a fully managed source control service that hosts secure Git-based repositories?

GitHub

Amazon S3

AWS CodeStar

AWS CodeCommit

Compare the feature sets of the two main open-source caching engines supported by ElastiCache.

83 / 136

Memcached.

MySQL.

Redis.

DynamoDB Accelerator (DAX).

Remember the order of precedence in IAM policy evaluation, specifically how ‘Deny’ is treated.

84 / 136

Create a single policy statement with `Effect: "Allow"` and list all EC2 actions except `ec2:TerminateInstances` in the `Action` element.

This is not possible; a policy cannot both allow a wildcard and deny a specific action within that wildcard.

Create one policy statement with `Effect: "Allow"`, `Action: "ec2:*"` and another statement with `Effect: "Allow"`, `Action: "ec2:TerminateInstances"`.

Create one policy statement with `Effect: "Allow"`, `Action: "ec2:*"` and a second, separate statement with `Effect: "Deny"`, `Action: "ec2:TerminateInstances"`.

What kind of token does a modern identity provider like Cognito issue upon successful authentication?

85 / 136

An API Gateway endpoint is protected by a Cognito User Pool authorizer. What must the client include in the request to be authenticated successfully?

The JSON Web Token (JWT) provided by Cognito after the user signs in.

A temporary security token from AWS STS.

A custom API key generated by API Gateway.

An IAM user's access key and secret key.

Which template section acts like a dictionary or a lookup table?

86 / 136

Mappings

Resources

Conditions

Parameters

Consider the endpoint type that requires a VPC endpoint for access.

87 / 136

An API Gateway REST API must be accessible only from within a specific VPC. No traffic from the public internet should be able to reach the API. What type of API endpoint should be configured?

Public

Edge-optimized

Regional

Private

Look for a feature within the S3 service settings for sending notifications about bucket events.

88 / 136

A Lambda function needs to be triggered whenever a new object is created in a specific S3 bucket. How should this be configured?

Set up an S3 event notification to trigger the Lambda function.

Deploy a Kinesis Data Firehose delivery stream to send S3 objects to the Lambda function.

Configure the Lambda function to poll the S3 bucket every second.

Use a CloudWatch Event (or EventBridge) rule that monitors S3 API calls via CloudTrail.

Look for the STS operation that explicitly mentions the required federation protocol.

89 / 136

`AssumeRoleWithSAML`

`GetSessionToken`

`AssumeRole`

`GetFederationToken`

Which service is dedicated to managing certificates for AWS endpoints?

90 / 136

AWS IAM Server Certificates.

AWS Key Management Service (KMS).

AWS Secrets Manager.

AWS Certificate Manager (ACM).

Look for a feature within the version control service itself that manages how changes are merged into protected branches.

91 / 136

A team uses a Git repository in AWS CodeCommit. They want to ensure that all code pushed to the `main` branch has been reviewed and approved by another team member. How can this be enforced?

Set up a branch permission in CodeCommit that requires pull requests for all changes to the `main` branch.

Create a CodeBuild project that automatically rejects pushes to `main`.

Use an IAM policy that denies the `git-receive-pack` action for all users except a designated lead developer.

Configure an AWS Config rule to monitor the `main` branch.

Which integration type passes the entire raw request to Lambda and expects a complete HTTP response structure back from Lambda?

92 / 136

An API is built using API Gateway with a Lambda integration. The API should return a custom HTTP status code (e.g., 201 Created) and custom headers. What type of integration must be used?

AWS service integration.

Lambda proxy integration.

HTTP proxy integration.

Lambda custom integration (non-proxy).

Which service provides a ‘service map’ to visualize the components of your application?

93 / 136

To trace and analyze user requests as they travel through a distributed system composed of API Gateway, Lambda, and DynamoDB, a developer needs to visualize the entire request path, identify performance bottlenecks, and debug errors. Which AWS service should be used?

AWS X-Ray.

Amazon CloudWatch Logs.

VPC Flow Logs.

AWS CloudTrail.

Consider the structure of a REST API, which involves resources and the actions (methods) you can perform on them.

94 / 136

Create a single Lambda function and use a large `if/else` block to check the `event.httpMethod`.

Use query string parameters to specify the intended action (e.g., `/items?action=delete`).

Create a separate API Gateway for each HTTP method.

Consider how permissions can be dynamically managed for running EC2 instances without service interruption.

95 / 136

A developer needs to give an EC2 instance permission to call the S3 `GetObject` API. The EC2 instance is already running. What is the most secure and efficient way to grant these permissions?

Modify the S3 bucket policy to allow access from the EC2 instance's public IP address.

Create an IAM user, generate access keys, and store them in a configuration file on the EC2 instance.

Stop the EC2 instance, create an IAM role with the required S3 permissions, attach the role to the instance, and restart it.

Create an IAM role with the required S3 permissions and use the `attach-role-to-instance` CLI command to apply it to the running instance.

Consider CloudFormation’s default behavior for maintaining stack integrity when an operation goes wrong.

96 / 136

A CloudFormation stack update fails. By default, what is the state of the stack after the failure?

The stack is automatically rolled back to its previous working state (`UPDATE_ROLLBACK_COMPLETE`).

The stack is deleted.

The stack enters a `UPDATE_IN_PROGRESS` state indefinitely until manually fixed.

The stack remains in the partially updated, failed state (`UPDATE_FAILED`).

Look for a feature within the version control service itself that manages how changes are merged into protected branches.

97 / 136

A team uses a Git repository in AWS CodeCommit. They want to ensure that all code pushed to the `main` branch has been reviewed and approved by another team member. How can this be enforced?

Use an IAM policy that denies the `git-receive-pack` action for all users except a designated lead developer.

Set up a branch permission in CodeCommit that requires pull requests for all changes to the `main` branch.

Create a CodeBuild project that automatically rejects pushes to `main`.

Configure an AWS Config rule to monitor the `main` branch.

Consider the CloudWatch feature that lets you perform calculations on existing metrics.

98 / 136

Metric Math.

CloudWatch Dashboards.

Embedded Metric Format (EMF).

CloudWatch Logs Insights.

Look for an encryption option in the settings of the CloudWatch Logs resource itself.

99 / 136

A Lambda function processes sensitive data and must write its logs to CloudWatch Logs. How can a developer ensure that the log data is protected at rest in CloudWatch Logs?

Enable server-side encryption for the CloudWatch log group using AWS KMS.

Manually encrypt the log message strings within the Lambda function code before logging.

CloudWatch Logs are encrypted by default and no action is needed.

Store the logs in an encrypted S3 bucket instead of CloudWatch Logs.

Which capacity mode follows a ‘pay-for-what-you-use’ model without needing to specify throughput in advance?

100 / 136

To optimize DynamoDB costs for a table with unpredictable read/write traffic, which capacity mode should be used?

Provisioned capacity mode with Auto Scaling.

On-demand capacity mode.

Static provisioned capacity mode.

Reserved capacity mode.

Check the available action types within a CodePipeline stage for a feature that pauses execution.

101 / 136

Use a CodeBuild action that pauses until a manual input is received.

Trigger a Lambda function that sends an email and waits for a reply before completing.

Configure an AWS Step Functions state machine with a wait state and integrate it with the pipeline.

Add a manual approval action to a new stage in the pipeline.

Think about how the server can identify and disregard duplicate requests from a client.

102 / 136

Require the client to generate and pass a unique idempotency key in the request header or body.

Use the HTTP GET method for all create operations.

Rely on the client to never send a duplicate request.

Decrease the API Gateway timeout to prevent long-running requests.

Consider API Gateway’s ability to act as a proxy directly to the APIs of other AWS services.

103 / 136

Use an HTTP proxy integration to a public DynamoDB endpoint.

This is not possible; a Lambda function is always required for API Gateway to interact with DynamoDB.

Use an AWS service integration (or non-proxy integration) that calls the DynamoDB `Scan` or `Query` API action directly.

Use a Lambda proxy integration.

Which service is AWS’s flagship for ingesting and processing ‘streams’ of data?

104 / 136

An application needs to process a real-time stream of data, such as clickstream data from a website. The data must be processed in order for each user, and multiple consumers must be able to read the same stream concurrently. Which service is designed for this use case?

Amazon SNS.

Amazon Kinesis Data Streams.

AWS Database Migration Service (DMS).

Amazon SQS.

Consider DynamoDB’s native feature for making write operations dependent on the state of an item.

105 / 136

A developer is writing a Python application using the Boto3 SDK to interact with DynamoDB. The application needs to write an item to a table but only if an item with the same primary key does not already exist. How can this be achieved efficiently?

Use a GetItem call to check for the item's existence before calling PutItem.

Use a conditional expression with the PutItem operation.

Implement optimistic locking using a version number attribute.

Enable DynamoDB Streams on the table to revert the write if a duplicate is found.

Look for a framework that acts as a transform on top of CloudFormation to simplify serverless definitions.

106 / 136

AWS Serverless Application Model (SAM).

AWS Elastic Beanstalk.

AWS CloudFormation.

AWS CDK (Cloud Development Kit).

Which service is designed for ‘object storage’ and is effectively unlimited in scale?

107 / 136

Amazon DynamoDB.

Amazon ElastiCache.

Amazon S3 (Simple Storage Service).

Amazon EBS (Elastic Block Store).

Which launch type provides a ‘serverless’ experience for running containers?

108 / 136

EC2 launch type.

Spot launch type.

External launch type.

Fargate launch type.

Consider the default safety mechanism of a deployment service when an error is encountered.

109 / 136

A developer is using AWS CodeDeploy to deploy an application to a fleet of EC2 instances. The deployment fails on a few instances. By default, what will CodeDeploy do?

Automatically terminate the failed instances and let the Auto Scaling group replace them.

Immediately roll back the entire deployment on all instances to the last known good version.

Stop the entire deployment and mark the overall deployment status as 'Failed'.

Continue the deployment to all other instances and report the failures at the end.

Consider how a software application programmatically interacts with external services.

110 / 136

What is the function of the AWS SDK in application development?

To define AWS infrastructure as code using YAML or JSON templates.

To provide language-specific APIs for calling AWS services from within your application code.

To provide a command-line interface for managing AWS resources.

To provide a web-based console for visually interacting with AWS services.

What kind of token does a modern identity provider like Cognito issue upon successful authentication?

111 / 136

An API Gateway endpoint is protected by a Cognito User Pool authorizer. What must the client include in the request to be authenticated successfully?

A temporary security token from AWS STS.

A custom API key generated by API Gateway.

An IAM user's access key and secret key.

The JSON Web Token (JWT) provided by Cognito after the user signs in.

Consider features within API Gateway itself for managing the structure of requests and responses.

112 / 136

An application consists of an API Gateway that invokes a Lambda function. The developer wants to validate the body of incoming POST requests against a JSON Schema before the request is sent to the Lambda function. How can this be achieved?

Use a Web Application Firewall (WAF) rule to validate the JSON body.

Perform the validation inside the Lambda function's code.

Create a model in API Gateway, define the JSON Schema, and associate it with the method request to enable request validation.

Configure an S3 bucket policy to validate the incoming data.

Think about how to scale a database horizontally for read operations.

113 / 136

To improve the read performance of a high-traffic, read-heavy RDS for PostgreSQL database, what is the MOST effective strategy?

Take more frequent database snapshots.

Create one or more Read Replicas and direct read queries to them.

Increase the size of the database instance (vertical scaling).

Enable Multi-AZ deployment.

Consider the hierarchy of IAM policy evaluation. Which effect is final?

114 / 136

What does an explicit `Deny` in an IAM policy statement do?

It only applies if no `Allow` statement for the action is found.

It overrides any `Allow` statements, preventing the action regardless of other policies.

It can be overridden by an `Allow` statement in another policy attached to the same principal.

It has no effect if there is an `Allow` for the same action.

Consider the unit of parallelism in a Kinesis Data Stream.

115 / 136

Switch from Kinesis Data Streams to Kinesis Data Firehose.

Increase the number of shards in the Kinesis Data Stream.

Decrease the batch size of the Lambda function.

Increase the memory of the Lambda function.

Look for a standard AWS CLI parameter that uses a specific query language for JSON.

116 / 136

Use the `–query` parameter with a JMESPath expression.

Use the `–filter` parameter.

Pipe the output to a command-line tool like `grep` or `awk`.

Use the `–output text` parameter.

Think about the AWS feature specifically designed to separate dependencies from function code for reusability.

117 / 136

A developer wants to reduce the size of a Lambda deployment package. The function uses several large, common libraries that are also used by other functions. What is the most efficient way to manage these shared libraries?

Create a Lambda layer containing the shared libraries and attach it to the functions that need it.

Install the libraries directly into the Lambda runtime using a startup script.

Bundle all libraries into every function's .zip file.

Store the libraries on an EFS filesystem and mount it to the Lambda function.

Think of a service that is part of a broader management suite and designed for storing ‘parameters’.

118 / 136

Amazon S3.

Amazon DynamoDB.

AWS AppConfig.

AWS Systems Manager Parameter Store.

Think about how a single broadcast message can be delivered to multiple independent listeners.

119 / 136

Dead-Letter Queue (DLQ) pattern.

Fan-out pattern.

Circuit breaker pattern.

Fan-in pattern.

How can you break down the timing information within a single trace segment?

120 / 136

Metadata

Subsegments

Annotations

A new segment

Consider features within API Gateway itself for managing the structure of requests and responses.

121 / 136

Create a model in API Gateway, define the JSON Schema, and associate it with the method request to enable request validation.

Configure an S3 bucket policy to validate the incoming data.

Use a Web Application Firewall (WAF) rule to validate the JSON body.

Perform the validation inside the Lambda function's code.

Which capacity mode follows a ‘pay-for-what-you-use’ model without needing to specify throughput in advance?

122 / 136

To optimize DynamoDB costs for a table with unpredictable read/write traffic, which capacity mode should be used?

On-demand capacity mode.

Provisioned capacity mode with Auto Scaling.

Reserved capacity mode.

Static provisioned capacity mode.

Think of a deployment strategy that involves two identical, parallel production environments.

123 / 136

All at once.

Blue/Green.

Rolling.

Rolling with additional batch.

Think about the AWS feature specifically designed to separate dependencies from function code for reusability.

124 / 136

Store the libraries on an EFS filesystem and mount it to the Lambda function.

Create a Lambda layer containing the shared libraries and attach it to the functions that need it.

Install the libraries directly into the Lambda runtime using a startup script.

Bundle all libraries into every function's .zip file.

Which integration type passes the entire raw request to Lambda and expects a complete HTTP response structure back from Lambda?

125 / 136

An API is built using API Gateway with a Lambda integration. The API should return a custom HTTP status code (e.g., 201 Created) and custom headers. What type of integration must be used?

HTTP proxy integration.

Lambda custom integration (non-proxy).

Lambda proxy integration.

AWS service integration.

Which mechanism is designed to isolate messages that repeatedly fail processing?

126 / 136

Configure Lambda Destinations for `on-failure` events.

Increase the function's memory and timeout.

Configure a Dead-Letter Queue (DLQ) on the SQS queue's redrive policy.

Use a try/catch block in the Lambda function to ignore the errors.

Which service is AWS’s flagship for ingesting and processing ‘streams’ of data?

127 / 136

Amazon Kinesis Data Streams.

Amazon SQS.

AWS Database Migration Service (DMS).

Amazon SNS.

Follow the principle of using IAM roles to grant permissions to AWS services.

128 / 136

During a CI/CD pipeline run with CodeBuild, the build process needs access to a password stored in AWS Secrets Manager. What is the recommended way to provide this access?

Hardcode the password as a plain text environment variable in the `buildspec.yml` file.

Create an IAM user, store its access keys in the `buildspec.yml`, and use them to retrieve the secret.

Pass the secret to the build using the `aws codebuild start-build` command's `–environment-variables-override` flag.

Grant the CodeBuild service role IAM permissions to read the secret from Secrets Manager.

Think of a ‘development kit’ that lets you write infrastructure definitions as if you were writing a regular software application.

129 / 136

AWS Elastic Beanstalk CLI.

AWS CloudFormation.

AWS Cloud Development Kit (CDK).

AWS Serverless Application Model (SAM).

Think about what information the server needs to hold (or not hold) between user interactions.

130 / 136

Which of the following is a key characteristic of a ‘stateless’ application?

It stores session data on the local disk of the server processing the request.

Each request from a client contains all the information needed to be understood and processed by the server.

It requires sticky sessions on the load balancer to function correctly.

It is difficult to scale horizontally.

Consider DynamoDB’s native feature for making write operations dependent on the state of an item.

131 / 136

Use a GetItem call to check for the item's existence before calling PutItem.

Implement optimistic locking using a version number attribute.

Enable DynamoDB Streams on the table to revert the write if a duplicate is found.

Use a conditional expression with the PutItem operation.

Look for the service in the AWS ‘Code’ suite that is analogous to GitHub or Bitbucket.

132 / 136

Which AWS service is a fully managed source control service that hosts secure Git-based repositories?

AWS CodeCommit

Amazon S3

GitHub

AWS CodeStar

Which service provides a ‘service map’ to visualize the components of your application?

133 / 136

VPC Flow Logs.

AWS CloudTrail.

AWS X-Ray.

Amazon CloudWatch Logs.

Think about the intermediate artifact that the CDK generates before deployment.

134 / 136

A developer is using the AWS CDK to define their infrastructure. What is the purpose of the `cdk synth` command?

It destroys all resources in the deployed stack.

It synthesizes the CDK code into a CloudFormation template.

It deploys the infrastructure directly to the AWS account.

It compares the current stack with the CDK code and shows a diff.

Consider the lifecycle of a message in an SQS queue and how consumers interact with it.

135 / 136

Decrease the visibility timeout to force faster message processing.

Switch to an SQS FIFO queue.

Implement long polling on the SQS queue.

Increase the visibility timeout to a value longer than the processing time and ensure the application deletes the message after successful processing.

Think of a service that acts as a central ‘bus’ for events from many different sources.

136 / 136

What is a primary use case for Amazon EventBridge?

To orchestrate complex, multi-step workflows with visual state machines.

To create a fully managed message queue for decoupling microservices.

To provide real-time, bidirectional communication for web applications.

To build a serverless event bus that connects applications with data from various sources, including AWS services, SaaS applications, and custom applications.

Your score is

Why High-Quality DVA-C02 Practice Is Your Competitive Edge

Serverless Security and Performance on the DVA-C02

Secure Access for Lambda Functions

Mitigating the Cold Start Problem (A Key DVA-C02 Focus)

Mastering AWS Messaging and Integration Services

Preventing Message Duplication in SQS

Handling Manual Approval in CI/CD Pipelines

Secure Development and Credential Management for the DVA-C02

Automating Secret Rotation with a Managed Service

Securing Public Access to Data

Conclusion

Related Posts

100 Free AWS Solutions Architect (SAA-C03) Practice Test Questions to Crush the Exam

Mastering the AWS Solutions Architect Associate (SAA-C03)

Essential Free AWS CLF-C01 Exam Dumps & Study Guide