Free AWS Developer Associate (DVA-C02) Practice Questions

Answer: B. Add Outputs with Export names to the networking stack and reference them in the application stack with Fn::ImportValue

Cross-stack references are the purpose-built mechanism for this. The networking stack declares each subnet ID in its Outputs section with an Export name, and the application stack retrieves the value with Fn::ImportValue, so no IDs are hardcoded or copied by hand.

Go deeper: What's the difference between a nested stack and two independent sibling stacks when it comes to referencing resources? Why might exporting too many values from one stack become a problem later when you try to update or delete it?

Source: official AWS documentation · verified 2026-07-11

Answer: C. Attach an ECR lifecycle policy rule that expires untagged images older than a set number of days

ECR lifecycle policies are the built-in cleanup mechanism: a rule with tagStatus 'untagged' and an age or count threshold makes ECR automatically expire matching images, requiring no pipeline changes, Lambda functions, or schedulers.

Go deeper: What's the difference between a lifecycle policy rule scoped to tagStatus 'untagged' versus one scoped to 'any'? How would you avoid accidentally expiring an image that's still deployed to production?

Source: official AWS documentation · verified 2026-07-11

Answer: D. Define a stage variable (for example, lambdaAlias) on each stage and reference it in the integration URI as ${stageVariables.lambdaAlias}

Stage variables exist precisely for this pattern. The integration URI can embed ${stageVariables.lambdaAlias}, and each stage supplies its own value (DEV or LIVE), so one API definition and one deployment fan out to different Lambda aliases per stage.

Go deeper: Besides the Lambda alias, what other integration settings might you want to vary per stage using stage variables? What permission do you still need to grant on each alias for stage variables with Lambda integrations to work end to end?

Source: official AWS documentation · verified 2026-07-11

Answer: A. Add the DynamoDBCrudPolicy SAM policy template to the function's Policies property, passing the table name

SAM policy templates are prebuilt, parameterized policies applied via the Policies property of AWS::Serverless::Function. DynamoDBCrudPolicy with TableName set (for example, via !Ref to the table resource) grants create, read, update, and delete actions scoped to that single table — least privilege with one line instead of a handwritten policy document.

Go deeper: What other SAM policy templates exist besides DynamoDBCrudPolicy, and when would you reach for a read-only or write-only variant instead? Why does scoping a policy to one table's ARN matter even if the account only has a handful of tables today?

Source: official AWS documentation · verified 2026-07-11

Answer: B. Attach the script to the AfterInstall lifecycle event in the appspec.yml hooks section

In an EC2/on-premises deployment, the CodeDeploy agent copies the revision's files to their destinations during the Install lifecycle event, and AfterInstall runs immediately afterward — before ApplicationStart launches the application. That is exactly the window needed to generate configuration from the newly copied files.

Go deeper: In what order do the CodeDeploy lifecycle events run for an in-place EC2 deployment, from ApplicationStop to ValidateService? Why does it matter whether a script needs the old application stopped versus the new files already present?

Source: official AWS documentation · verified 2026-07-11

Answer: B. Use the AWS Parameters and Secrets Lambda Extension to cache the parameter value in-memory with a configurable TTL

The AWS Parameters and Secrets Lambda Extension caches Parameter Store values (and Secrets Manager secrets) locally in the execution environment, reducing redundant API calls. The developer can configure a TTL to control how frequently the cache is refreshed.

Go deeper: What tradeoff does a longer cache TTL introduce between API call volume and configuration freshness? Why does caching in the execution environment work well with Lambda's reuse of warm environments across invocations?

Source: official AWS documentation · verified 2026-07-11

Answer: A. Switch to a FIFO SQS queue and provide a MessageDeduplicationId on each SendMessage call

FIFO SQS queues natively support exactly-once message delivery within a 5-minute deduplication interval. By supplying a consistent MessageDeduplicationId (e.g., a hash of the message body or a business key) on each SendMessage attempt, SQS discards any message with the same deduplication ID received within that window.

Go deeper: What would you use as the MessageDeduplicationId if the message body itself might vary slightly between retries? Why does switching from Standard to FIFO involve throughput tradeoffs you'd need to weigh?

Source: official AWS documentation · verified 2026-07-11

Answer: C. The EventBridge rule's IAM role lacks codepipeline:StartPipelineExecution permission on the pipeline resource

When CodePipeline is configured to use an EventBridge (CloudWatch Events) rule to trigger on CodeCommit changes, the rule needs an IAM role that includes codepipeline:StartPipelineExecution permission targeted at the specific pipeline ARN. Without this, EventBridge can detect the event but cannot invoke the pipeline.

Go deeper: Which resource's IAM role is responsible for starting the pipeline execution — the pipeline's own role, or the EventBridge rule's role? How would you verify in CloudTrail whether the EventBridge rule even attempted to invoke the pipeline?

Source: official AWS documentation · verified 2026-07-11

Answer: A. A GSI on a low-cardinality attribute causes hot partition issues; a better approach is to use a composite GSI partition key that appends a random suffix to status, called partition sharding

A GSI partition key with only three distinct values concentrates all reads and writes onto three logical partitions, creating hot partitions that can be quickly throttled. The recommended mitigation is write sharding: append a random suffix (e.g., status#1, status#2) to distribute load, then query all shards in parallel and merge results.

Go deeper: If you shard the status attribute into status#1 through status#N, how does the application know which shards to query and merge? What attribute in this table would make a better GSI partition key than status, and why?

Source: official AWS documentation · verified 2026-07-11

Answer: B. AWS_PROXY integration type so API Gateway passes the full request context to Lambda

The AWS_PROXY (Lambda proxy) integration passes the entire HTTP request to Lambda as a structured event object containing the body, headers, HTTP method, path parameters, query string parameters, and requestContext (which includes sourceIp). The Lambda function is responsible for building the full HTTP response.

Go deeper: What does the Lambda function have to build and return itself when using AWS_PROXY that a non-proxy integration would otherwise handle for it? Where in the event object would you find the caller's source IP address?

Source: official AWS documentation · verified 2026-07-11

Answer: B. Attach an inline or managed IAM policy granting dynamodb:PutItem on the specific table ARN to the Lambda execution role

The correct approach follows the principle of least privilege: attach an IAM policy that grants only dynamodb:PutItem on the specific table ARN to the Lambda's execution role. Lambda assumes this role at runtime and obtains temporary credentials automatically via STS.

Go deeper: Why does using the execution role avoid the need for any credentials to be stored or rotated at all? What single IAM action beyond PutItem might you still need if the function also reads existing items before writing?

Source: official AWS documentation · verified 2026-07-11

Answer: A. When a role is assumed using another role's temporary credentials (role chaining), the session is limited to a maximum of 1 hour regardless of the role's configured maximum session duration

Using role session credentials to assume another role is called role chaining, and AWS caps chained sessions at 1 hour no matter what maximum session duration is configured on the target role. Requesting 14400 seconds in a chained AssumeRole call therefore fails validation; the code must request 3600 seconds or less, or re-assume the role when the session expires.

Go deeper: What would you have to change in the code to keep working within a 1-hour chained session limit for a long-running batch job? How is role chaining different from a Lambda execution role directly assuming a single target role?

Source: official AWS documentation · verified 2026-07-11

Answer: A. Encryption context acts as additional authenticated data; a Decrypt request must supply exactly the same encryption context that was used in the Encrypt request or decryption fails

Encryption context is a set of non-secret key-value pairs that KMS cryptographically binds to the ciphertext as additional authenticated data (AAD) for symmetric encryption operations. If any encryption context was supplied at Encrypt time, the Decrypt call must supply the identical context; otherwise KMS cannot authenticate the ciphertext and fails with InvalidCiphertextException. The reporting service must read the tenant ID stored with each record and pass the same {"tenant": ...} pair on Decrypt.

Go deeper: Where would the reporting service need to look to find the tenant ID it must pass back into the Decrypt call? Why does binding encryption context as AAD protect against a ciphertext being decrypted in the wrong tenant's context?

Source: official AWS documentation · verified 2026-07-11

Answer: A. A bucket policy that denies all S3 actions when the condition aws:SecureTransport is false

The aws:SecureTransport global condition key is true when a request is made over TLS. A bucket policy with an explicit Deny for all principals and actions when aws:SecureTransport is false rejects any HTTP request, enforcing encryption in transit exactly as required.

Go deeper: Why does the policy need to deny rather than just fail to allow HTTP requests? How would you test that the policy actually rejects a plain HTTP request without accidentally breaking legitimate HTTPS traffic?

Source: official AWS documentation · verified 2026-07-11

Answer: B. An Amazon Cognito identity pool

Cognito identity pools (federated identities) exchange a token from an identity provider such as Google for temporary, limited-privilege AWS credentials obtained through STS, which is exactly what the app needs to call S3 directly.

Go deeper: How could a user pool and an identity pool work together in the same app, given they serve different purposes? What happens to the temporary AWS credentials the app receives once the user's session ends?

Source: official AWS documentation · verified 2026-07-11

Answer: B. Add an Amazon Cognito user pool authorizer (or Lambda authorizer) to authenticate callers, and keep API keys only for usage plans and throttling

AWS explicitly documents that API keys are for identifying clients in usage plans — metering and throttling — and should not be used as the sole mechanism for authentication or authorization. The correct fix is to add a real authorizer (Cognito user pool, Lambda authorizer, or IAM/SigV4 auth) so each caller is authenticated, while API keys remain useful for per-client rate limits and quotas.

Go deeper: What's the functional difference between an API key and a token issued by a Cognito user pool authorizer? Why would relying only on a shared static key make it hard to revoke access for a single compromised customer?

Source: official AWS documentation · verified 2026-07-11

Answer: A. Configure reserved concurrency on the API function to guarantee it a dedicated portion of the account's concurrency

All functions in an account and Region share one concurrency pool by default, so the batch functions can starve the API function. Reserved concurrency carves out a dedicated slice of the pool that no other function can consume (and simultaneously caps the batch functions' impact), so the API function always has capacity to scale during the nightly window.

Go deeper: What happens to the batch team's functions once you carve out reserved concurrency for the API function? How would you decide how large to set the reserved concurrency value for the API function?

Source: official AWS documentation · verified 2026-07-11

Answer: A. Run a CloudWatch Logs Insights query on the log group using filter and stats commands with a one-hour bin

CloudWatch Logs Insights is purpose-built for this: it runs interactive, ad-hoc queries directly against log groups, automatically discovers JSON fields, and supports commands like filter to match the error code and stats count(*) by bin(1h) to aggregate per hour — with no setup beyond writing the query.

Go deeper: Why does the retroactive nature of the analysis rule out metric filters here? What Logs Insights command would you chain after filter to get counts grouped into one-hour buckets?

Source: official AWS documentation · verified 2026-07-11

Answer: A. Use the SQS dead-letter queue redrive capability to move the messages back to the source queue

SQS provides a built-in dead-letter queue redrive feature (available in the console and via the StartMessageMoveTask API) that moves messages from a DLQ back to their source queue in a managed, throttle-controlled way — no custom code required, which directly satisfies the requirement.

Go deeper: Why does a throttle-controlled redrive matter when moving 8,000 messages back into a live source queue? What would happen to a message that fails processing again after being redriven back to the source queue?

Source: official AWS documentation · verified 2026-07-11

Answer: A. Return the Access-Control-Allow-Origin header in the response object generated by the Lambda function

With Lambda proxy integration, API Gateway passes the backend response through without applying method or integration response mappings, so the console's "Enable CORS" action only fixes the mock-integration OPTIONS preflight. The actual POST response headers come entirely from the Lambda function, which must therefore include Access-Control-Allow-Origin (and related CORS headers) in the headers field of its returned response object.

Go deeper: Why does the console's 'Enable CORS' button not fully solve CORS when using Lambda proxy integration? What other CORS-related headers besides Access-Control-Allow-Origin might the Lambda response need to include?

Source: official AWS documentation · verified 2026-07-11