AWS Certified Developer - Associate (DVA-C02) Practice Exam
Unlock your potential as a software developer with the AWS Certified Developer - Associate Exam Simulator! Prepare thoroughly with realistic practice exams designed to mirror the official exam.
Exam domains
The DVA-C02 questions are grouped into 4 domains divided into 13 tasks.
DVA-C02 example questions
One example question per domain from the DVA-C02 question bank, with the correct answer and its explanation. Sign in to the simulator to answer them with all answer options.
A developer configures an AWS Lambda function to use private subnets in a VPC so that it can call an internal inventory service. The function successfully calls the internal service, but calls to a third-party HTTPS API now time out. The third-party API is available only through a public IPv4 endpoint and does not support AWS PrivateLink. DNS resolution succeeds, and security groups and network ACLs allow the required traffic. The private subnet route tables contain only the VPC local route. The VPC also has a public subnet with a route to an internet gateway. Which change will allow the function to call both services?
Show answer
CORRECT ANSWERCreate a public NAT gateway with an Elastic IP address in the public subnet. Add a default IPv4 route to that NAT gateway in the route tables associated with the function's private subnets.
The public NAT gateway provides outbound IPv4 internet connectivity for the function's private addresses. The public subnet's internet gateway route completes the internet path. The existing VPC local route continues to carry traffic to the internal inventory service.
A company is developing a multi-tenant mobile application. Users authenticate with an Amazon Cognito user pool. An administrator assigns each user a custom:tenantId attribute that app clients cannot modify. Several users belong to each tenant and must share access to that tenant's records. Records are stored in one Amazon DynamoDB table with tenantId as the partition key and recordId as the sort key. The mobile application must call DynamoDB directly by using temporary AWS credentials. Users must be allowed to perform only GetItem and Query operations on their own tenant's records. The company wants to use a single IAM permissions policy for all tenants. Which solution meets these requirements?
Show answer
CORRECT ANSWERCreate a Cognito identity pool that trusts the user pool. Map custom:tenantId to a tenantId principal tag. Configure the authenticated role to accept session tags, and allow GetItem and Query on the table only when all dynamodb:LeadingKeys values equal ${aws:PrincipalTag/tenantId}.
The identity pool exchanges the authenticated user's token for temporary AWS credentials. Its attribute mapping carries the administrator-controlled tenant identifier into the role session as a principal tag. A ForAllValues:StringEquals condition on dynamodb:LeadingKeys restricts the permitted operations to the matching tenant partition. Users in the same tenant receive the same tenant tag and can share records without receiving access to other tenants.
A team maintains a single AWS Lambda function. Its deployment pipeline must provide stable invocation ARNs for automated integration tests and production clients. While integration tests run, other builds can update the function's unpublished code. The tests must continue invoking exactly the candidate revision selected at the start of the test run, and production must remain unchanged. After approval, the pipeline must promote the tested revision and support rollback without uploading code again. Which solution meets these requirements?
Show answer
CORRECT ANSWERPublish a version for each candidate and maintain test and production aliases. Point the test alias to the candidate version and leave it unchanged during the tests. After approval, update the production alias to that version. Roll back by pointing the production alias to the previous version.
Published Lambda versions preserve immutable snapshots of function code and version-specific configuration. Aliases provide stable invocation ARNs that reference published versions. Keeping the test alias unchanged isolates the test run from updates to unpublished code. Updating the production alias promotes the tested version or restores a previous version without uploading code.
A developer updates an Amazon API Gateway REST API to invoke the prod alias of an AWS Lambda function instead of the test alias. After the API is redeployed, requests return HTTP 500. API Gateway execution logs report "Invalid permissions on Lambda function," and no invocations reach the prod alias. The API uses Lambda proxy integration without an IAM credentials role. Clients are authorized to invoke the API. The Lambda resource-based policy permits apigateway.amazonaws.com to invoke only the test alias, and no explicit deny policies apply. Which change should the developer make to resolve the integration failure while maintaining least-privilege access?
Show answer
CORRECT ANSWERAdd a resource-based permission to the prod alias that allows apigateway.amazonaws.com to perform lambda:InvokeFunction, with a SourceArn condition restricted to the intended API stage, method, and resource.
API Gateway needs permission to invoke the alias ARN targeted by the integration. The permission on the test alias does not authorize invocation of the prod alias. An alias-specific resource-based permission with a restricted API execution SourceArn grants the required access without unnecessarily broadening it.
Exam mode and practice mode
| Exam mode | Practice mode | |
|---|---|---|
| Questions count | 65 | 1 - 75 |
| Time limit | 130 minutes | Optional, 10 - 200 minutes |
| Exam scope | 4 domains with the official questions ratio | Selected domains with the official questions ratio |
| Correct answers | After exam submission | After exam submission or after each answer |
| Question types | Mix of single and multiple correct answers | Single, multiple or both |
| Question hints | Never | Optional |
| Question domain | Revealed after exam submission | Revealed after submission or during the exam |
| Scoring | 15 of 65 questions do not count towards the result | Official AWS method or mathematical mean |
See all simulator features on the AWS Exam Simulator page.
About the DVA-C02 exam
The AWS Certified Developer - Associate certification is challenging due to its comprehensive coverage of AWS services and its focus on the practical application of development principles within the AWS ecosystem. This certification tests your ability to design, develop, and deploy cloud-based applications on AWS, requiring a solid understanding of core AWS services and best practices for development and architecture.
The certification exam emphasizes an understanding of key AWS services such as EC2, S3, DynamoDB, Lambda, API Gateway, RDS, and others. You need to know how these services work, how to configure them, and how to integrate them into applications.
You have to be able to solve real-world problems, including designing scalable and resilient applications, troubleshooting issues, and optimizing performance and cost. Understanding deployment and monitoring practices is also essential, including familiarity with CI/CD (Continuous Integration and Continuous Deployment) pipelines using AWS services like CodeCommit, CodeBuild, CodeDeploy, and CodePipeline.
Security is another critical aspect. Candidates must know how to implement security best practices, including identity and access management, encryption, and securing data in transit and at rest. They should be able to use IAM roles and policies effectively to secure their applications.
The certification also requires knowledge of AWS's global infrastructure, including regions and availability zones, and how to design applications that take advantage of this infrastructure for high availability and fault tolerance.
Furthermore, the exam demands familiarity with microservices architecture and the ability to implement serverless applications using AWS Lambda and other related services. This involves understanding the benefits and challenges of microservices and how to manage them on AWS.
The AWS Certified Developer - Associate certification is far more challenging than the AWS Certified Cloud Practitioner because it requires a comprehensive understanding of AWS services and the ability to apply best practices in security, architecture, and deployment. However, it is considered easier than the AWS Certified Solutions Architect - Associate because it encompasses a shorter exam scope.
Technologies and concepts
Compute
In the cloud, compute provides on-demand CPU, memory, and optional accelerators through virtual machines, containers, and managed execution environments. Choosing an appropriate compute model helps engineers balance performance, cost, scaling behavior, and operational responsibility.
Cost management
In the cloud, cost management connects resource consumption and pricing choices to business outcomes. It helps engineers compare deployment options, eliminate waste, and balance spending against performance, availability, security, and operational effort.
Database
Databases give applications controlled access to persistent information, such as customer records, orders, and device readings. Choosing the right database model and operating approach affects correctness, performance, availability, security, and cost.
Management and governance
Management handles activities such as provisioning, monitoring, configuration, and remediation, while governance defines who may act, which standards apply, and how compliance is demonstrated. Together, they help organizations give engineers useful autonomy without losing accountability, cost visibility, or control over risk.
Networking, connectivity, and content delivery
This concept combines network isolation, addressing, routing, name resolution, hybrid connectivity, traffic distribution, and delivery from geographically distributed edge locations. Engineers use these capabilities to balance reachability, security, latency, availability, and cost across public-facing applications and private systems.
Security
Security combines technical controls, operational processes, and clearly assigned responsibilities to preserve confidentiality, integrity, and availability. In the cloud, providers secure the underlying infrastructure while customers configure and operate their workloads securely, using capabilities such as identity controls, encryption, network protection, and threat detection.
Storage
Cloud storage provides data capacity through managed services rather than requiring engineers to operate all underlying disks and storage systems. Choosing an appropriate storage model and tier requires balancing access patterns, performance, resilience, retention requirements, and total cost.
Analytics
Analytics turns raw records, events, and measurements into useful information through querying, aggregation, statistical analysis, and visualization. In the cloud, managed storage and processing services let engineers analyze changing data volumes without building every infrastructure component themselves.
Containers
Containers provide a repeatable way to build, distribute, and run software across development and cloud environments. They improve deployment consistency and resource utilization, but require explicit controls for image security, runtime isolation, networking, identity, and persistent data.
Developer tools
Developer tools support the software development lifecycle, from local coding and version control to automated builds and production releases. In cloud environments, they connect development workflows to programmable infrastructure, managed execution environments, and identity controls so teams can deliver changes consistently and trace failures.
Services on the exam
All 55 AWS services that can appear on the DVA-C02 exam.