DVA-C02 Practice Questions — Free

Question 1 of 25

That system must let a diner cancel and immediately free the slot for others. What DynamoDB operation and condition fit?

• A.A PutItem writing an empty item over the reservation
• B.DeleteItem conditioned on the diner owning the reservationCorrect
• C.An unconditional DeleteItem on the reservation key
• D.A Scan followed by deleting every matching reservation

Question 2 of 25

An SQS consumer needs more time to process a particularly large or slow message before it becomes visible again to other consumers. What should be adjusted for that specific message?

• A.Switch the entire queue from standard to FIFO, which extends visibility timeout
• B.Delete and immediately re-send the message with a longer default timeout
• C.Reduce the queue's overall message retention period for all messages
• D.Extend the message's visibility timeout using ChangeMessageVisibilityCorrect

Question 3 of 25

An application ingests high-volume, real-time clickstream data and needs to process it as it arrives, rather than in scheduled batches. Which service is designed for this?

• A.Amazon S3 Glacier, designed for long-term archival, not real-time ingestion
• B.Amazon Kinesis Data StreamsCorrect
• C.AWS Snowball, designed for offline bulk physical data transfer
• D.AWS Database Migration Service, designed for migrating existing databases

Question 4 of 25

That feature-flag service must roll a flag change out gradually and roll back automatically if errors rise. What AppConfig feature does this?

• A.Deployment strategies with CloudWatch alarm-based rollbackCorrect
• B.Manual flag toggling performed separately per function
• C.A DynamoDB Stream on the table that stores the flags
• D.Immediate deployment of the new flag value to all targets

Question 5 of 25

An application's Lambda function needs to return a response to API Gateway that includes custom HTTP headers (like a CORS header) alongside the response body. What must the function's return value structure include?

• A.A separate API call to a headers-specific endpoint after the main response is returned
• B.Headers can only ever be set by API Gateway itself, never by the Lambda function
• C.A structured response object with separate statusCode, headers, and body fieldsCorrect
• D.Only the raw response body as a plain string, with no other structure supported

Question 6 of 25

A developer wants a Lambda function to be invoked every 15 minutes with no external event. What should be configured?

• A.A DynamoDB stream attached to a table as the trigger
• B.An SQS queue with a 15-minute delivery delay set
• C.An EventBridge scheduled rule with a rate expressionCorrect
• D.An S3 event notification configured on a bucket

Question 7 of 25

An SQS queue needs to guarantee messages are processed in the exact order they were sent, with no duplicate processing. What should be used?

• A.A standard SQS queue, which does not guarantee strict ordering or exactly-once delivery
• B.Amazon SNS alone, a pub/sub service rather than an ordered queue
• C.Increasing the standard queue's visibility timeout, which does not affect message ordering
• D.An SQS FIFO queue, which preserves order and exactly-once processing within a message groupCorrect

Question 8 of 25

A developer wants to trace a request as it flows through API Gateway, Lambda, and DynamoDB, identifying where latency is actually occurring across that chain. What should be enabled?

• A.CloudWatch Metrics alone, which reports aggregate numbers rather than per-request traces
• B.AWS Config, which tracks resource configuration rather than tracing request latency
• C.AWS X-Ray, tracing requests across services to visualize latency and bottlenecksCorrect
• D.CloudTrail, which logs API management activity rather than tracing request latency

Question 9 of 25

A developer building a video platform needs uploaded videos transcoded into three resolutions in parallel, then a manifest generated once all three finish. What orchestration fits?

• A.One Lambda doing all three sequentially inside 15 minutes
• B.A Parallel state with three branches, then a manifest taskCorrect
• C.An SQS queue with one consumer handling resolutions in turn
• D.Three separate Lambda functions with no coordination

Question 10 of 25

A developer wants CloudFront to be the only way to reach an S3 origin, blocking direct bucket URLs. What should be configured?

• A.Origin Access Control plus a bucket policy scoped to the distributionCorrect
• B.Disabling static website hosting on the origin S3 bucket
• C.Generating a presigned URL for every single object on demand
• D.Making the bucket and every object in it publicly readable

Question 11 of 25

A developer wants a KMS key using a public/private key pair, so external parties can encrypt data with a public key without needing AWS credentials, while only the application can decrypt with the private key. What KMS key type supports this?

• A.A standard symmetric KMS key, which uses one shared key for both encrypt and decrypt
• B.A KMS key with automatic annual rotation enabled, unrelated to symmetric vs asymmetric type
• C.A multi-Region KMS key, which addresses cross-Region replication rather than key type
• D.An asymmetric KMS key, using a public/private key pair rather than a single symmetric keyCorrect

Question 12 of 25

A developer must ensure a Lambda function's environment variables containing a config value are encrypted with a company-controlled key rather than the default. What should be set?

• A.Base64 encoding of the configuration values before setting
• B.Storing the configuration values inside the function code
• C.A customer managed KMS key for environment variable encryptionCorrect
• D.No change, since environment variables are stored as plaintext

Question 13 of 25

An application's Lambda function needs to decrypt data encrypted with a KMS key owned by a different AWS account, as part of a legitimate cross-account architecture. What must be true for this to succeed?

• A.Cross-account KMS decryption isn't achievable under any configuration, regardless of key policy
• B.Only the calling account's own IAM policy matters; the key's policy elsewhere is irrelevant
• C.The key's policy must grant the calling account's role decrypt access, and its own IAM policy must tooCorrect
• D.The key must be copied entirely into the calling account before it can be used there

Question 14 of 25

A developer's API Gateway must accept requests only from the company's mobile app, not from arbitrary callers who obtain the endpoint. What is the appropriate mechanism?

• A.IP allowlisting, even though mobile IPs change constantly
• B.Relying on the endpoint URL never being published anywhere
• C.Cognito or a Lambda authorizer validating a per-user tokenCorrect
• D.An API key embedded in the app, which can be extracted

Question 15 of 25

A developer's SAM template needs to define an EventBridge scheduled rule that triggers a Lambda function nightly. What SAM resource type or event source supports this without writing raw CloudFormation for the rule?

• A.A Schedule event source defined directly on the Lambda function's SAM resourceCorrect
• B.Only a raw AWS::Events::Rule CloudFormation resource can define a scheduled trigger
• C.A DynamoDB Stream event source, which is unrelated to time-based scheduling
• D.SAM does not support any form of scheduled Lambda trigger under any configuration

Question 16 of 25

That team's SAM template has a Lambda function referencing a local code directory. What sequence packages and deploys it?

• A.sam build, then sam deployCorrect
• B.cloudformation create-stack directly on the template
• C.npm publish, then sam deploy
• D.docker push, then cloudformation deploy

Question 17 of 25

A developer's Lambda function needs a large shared dependency used by five other functions. What avoids bundling it five times?

• A.Increasing each function's memory
• B.Merging all five functions into one
• C.A Lambda layer attached to each functionCorrect
• D.Copying the dependency into each package

Question 18 of 25

That team's ECS task definition references image tag 'latest', and a redeploy did not pick up the new image. Why?

• A.Fargate task definitions do not support image tag references
• B.The new image was pushed to a repository in the wrong Region
• C.ECS on Fargate is unable to pull images from ECR repositories
• D.The tag reference did not change, so ECS saw nothing to roll outCorrect

Question 19 of 25

A developer wants CloudFormation to fail early if a parameter value is outside an allowed set. What template feature enforces this?

• A.AllowedValues or AllowedPattern on the ParameterCorrect
• B.A Mapping keyed by the parameter's value
• C.A Condition evaluated during resource creation
• D.An Output declared for the parameter's value

Question 20 of 25

An application's CodeBuild project needs access to a private npm registry requiring authentication during the build phase, without hardcoding the registry credential in buildspec.yml. What is the recommended approach?

• A.Email the credential to each developer to manually paste into their local environment
• B.Commit the credential to the source repository alongside the application code
• C.Hardcode the credential directly as a plaintext value within buildspec.yml
• D.Retrieve the credential from Secrets Manager or Parameter Store within the build phaseCorrect

Question 21 of 25

An application's Lambda function's Duration metric shows a value very close to, but never exceeding, its configured timeout on every single invocation. What is the most likely explanation?

• A.This pattern is coincidental and does not indicate anything worth investigating
• B.The function's memory allocation is irrelevant to this specific pattern and needs no review
• C.The function is genuinely close to timing out and the timeout or code likely needs reviewCorrect
• D.CloudWatch is rounding the Duration metric incorrectly, and the real values are actually much lower

Question 22 of 25

An application's Step Functions execution fails at a specific state, and the developer wants to see exactly what input that state received and what error caused the failure. Where should this be reviewed?

• A.AWS Config, which tracks resource configuration rather than individual execution detail
• B.CloudWatch Metrics alone, which shows aggregate execution counts rather than per-state detail
• C.The state machine's definition file alone, which shows intended structure, not actual execution detail
• D.The Step Functions execution's event history, showing input, output, and error detail per stateCorrect

Question 23 of 25

A developer's application shows increased latency specifically on cold-started Lambda invocations for a function using a container image, compared to a similarly-sized zip-based function. What is a likely contributing factor?

• A.Image size has no measurable relationship to cold-start initialization time
• B.Zip-based functions always have strictly worse cold-start latency than any image
• C.Container images tend to be larger and can take longer to initialize on a cold startCorrect
• D.Container image-based functions never experience a cold start at all

Question 24 of 25

A DynamoDB table is experiencing throttled requests during a traffic spike, and CloudWatch metrics show ConsumedWriteCapacityUnits nearing the table's provisioned limit uniformly across all partitions. What is a reasonable next step?

• A.Enable DynamoDB Streams, which captures change events rather than addressing capacity throttling
• B.Increase provisioned write capacity, or switch to On-Demand mode if traffic is genuinely unpredictableCorrect
• C.Redesign the partition key, since uniform consumption across partitions indicates a hot-partition problem
• D.Add a Global Secondary Index, which addresses query patterns rather than overall capacity

Question 25 of 25

A developer's Lambda function works locally but fails in AWS with 'Unable to import module'. What is the most likely cause?

• A.The function's configured timeout value is too short
• B.The function is deployed in a different Region than expected
• C.A dependency is missing from the package or layerCorrect
• D.The execution role lacks a required IAM permission