DVA-C02PRACTICE QUESTIONS

DVA-C02 practice questions with answers

4 example questions from the AWS Certified Developer - Associate question bank, grouped by exam domain. Pick an answer and check it to see the explanation.

Development with AWS Services

Question 1Select 1

null Develop code for AWS Lambda

A developer configures an AWS Lambda function to use private subnets in a VPC so that it can call an internal inventory service. The function successfully calls the internal service, but calls to a third-party HTTPS API now time out. The third-party API is available only through a public IPv4 endpoint and does not support AWS PrivateLink. DNS resolution succeeds, and security groups and network ACLs allow the required traffic. The private subnet route tables contain only the VPC local route. The VPC also has a public subnet with a route to an internet gateway. Which change will allow the function to call both services?

A. Create an interface VPC endpoint for AWS Lambda in the private subnets and enable private DNS so that the function's HTTPS requests use the endpoint.

B. Create a private NAT gateway in one of the private subnets. Add a default IPv4 route to that gateway in the function's subnet route tables and a default route from the gateway's subnet to the internet gateway.

C. Move the function's VPC configuration to the public subnet so that Lambda receives a public IPv4 address and uses the internet gateway.

D. Create a public NAT gateway with an Elastic IP address in the public subnet. Add a default IPv4 route to that NAT gateway in the route tables associated with the function's private subnets.

Security

Question 1Select 1

null Manage sensitive data in application code

A company is developing a multi-tenant mobile application. Users authenticate with an Amazon Cognito user pool. An administrator assigns each user a custom:tenantId attribute that app clients cannot modify. Several users belong to each tenant and must share access to that tenant's records. Records are stored in one Amazon DynamoDB table with tenantId as the partition key and recordId as the sort key. The mobile application must call DynamoDB directly by using temporary AWS credentials. Users must be allowed to perform only GetItem and Query operations on their own tenant's records. The company wants to use a single IAM permissions policy for all tenants. Which solution meets these requirements?

A. Create a Cognito identity pool that trusts the user pool. Map the user pool sub claim to a tenantId principal tag. Configure the authenticated role to accept session tags, and allow GetItem and Query on the table only when all dynamodb:LeadingKeys values equal ${aws:PrincipalTag/tenantId}.

B. Create a Cognito identity pool that trusts the user pool. Map custom:tenantId to a tenantId principal tag. Configure the authenticated role to accept session tags, and allow GetItem and Query on the table only when all dynamodb:LeadingKeys values equal ${aws:PrincipalTag/tenantId}.

C. Create a Cognito identity pool that trusts the user pool and grants the authenticated role GetItem and Query permissions on the table. Have the mobile application read custom:tenantId from the user's token and include that value as the partition key in every request.

D. Create a Cognito user pool group for each tenant and add each user to the appropriate group. Use a Cognito identity pool to assign every group the same authenticated IAM role, with GetItem and Query permissions on the table. Rely on the cognito:groups claim to restrict each request to the group's tenant partition.

Deployment

Question 1Select 1

null Automate deployment testing

A team maintains a single AWS Lambda function. Its deployment pipeline must provide stable invocation ARNs for automated integration tests and production clients. While integration tests run, other builds can update the function's unpublished code. The tests must continue invoking exactly the candidate revision selected at the start of the test run, and production must remain unchanged. After approval, the pipeline must promote the tested revision and support rollback without uploading code again. Which solution meets these requirements?

A. Keep the production alias on its current published version and run integration tests against the unqualified function ARN. Record the function's revision ID when testing begins. After the tests pass, publish the current code and update the production alias to the new version.

B. Publish dedicated test and production versions and create an alias for each. Upload each candidate directly to the test version while its alias remains unchanged. After approval, upload the same code to the production version, retaining the previous deployment package for rollback.

C. Create test and production aliases that both reference $LATEST. Use the revision ID returned by each code update as the Qualifier on test invocations. After approval, configure the production alias to use that revision ID, and retain the previous revision ID for rollback.

D. Publish a version for each candidate and maintain test and production aliases. Point the test alias to the candidate version and leave it unchanged during the tests. After approval, update the production alias to that version. Roll back by pointing the production alias to the previous version.

Troubleshooting and Optimization

Question 1Select 1

null Assist in a root cause analysis

A developer updates an Amazon API Gateway REST API to invoke the prod alias of an AWS Lambda function instead of the test alias. After the API is redeployed, requests return HTTP 500. API Gateway execution logs report "Invalid permissions on Lambda function," and no invocations reach the prod alias. The API uses Lambda proxy integration without an IAM credentials role. Clients are authorized to invoke the API. The Lambda resource-based policy permits apigateway.amazonaws.com to invoke only the test alias, and no explicit deny policies apply. Which change should the developer make to resolve the integration failure while maintaining least-privilege access?

A. Update the REST API resource policy to allow the authorized client principals to perform execute-api:Invoke on the deployed method.

B. Add a resource-based permission to the prod alias that allows apigateway.amazonaws.com to perform lambda:InvokeFunction, with a SourceArn condition restricted to the intended API stage, method, and resource.

C. Update the Lambda execution role's trust policy to allow apigateway.amazonaws.com to perform sts:AssumeRole.

D. Add lambda:InvokeFunction permission for the prod alias ARN to the Lambda function's execution role.

PRACTICE EXAMDVA-C02 exam simulator

399 questions covering every domain and task, full-length exams, explanations for every answer and a pass probability indicator.

Open the simulator →