8 AWS Developer Associate Practice Questions That Mirror the Real Exam
Here are 8 multiple-choice questions designed to mirror the difficulty, style, and domain coverage of the AWS Developer Associate (DVA-C02) exam. They focus on practical application, architectural decisions, and troubleshooting—not just rote memorization.
These questions target key areas like DynamoDB, Lambda, CI/CD, API Gateway, S3, ECS, and security. Read each scenario carefully, as the "best" answer often depends on the specific constraints mentioned (e.g., latency, cost, or operational overhead). Related reading: AWS Developer Associate Passing Score: Why 720 Feels Closer Than It Looks.
Question 1
A developer is writing a Lambda function that processes records from an Amazon Kinesis Data Stream. The function is failing with a ProvisionedThroughputExceededException when writing results to DynamoDB. The Lambda function's retry behavior is causing duplicate writes to DynamoDB. What is the most efficient way to make the write operation idempotent and handle the throttling?
A. Use a DynamoDB transaction with ConditionExpression to check for the existence of the partition key before writing.
B. Implement exponential backoff in the Lambda function using the AWS SDK's built-in retry mechanism and capture the SequenceNumber from the Kinesis record to use as the DynamoDB sort key.
C. Increase the Lambda function's reserved concurrency to reduce the number of concurrent invocations hitting DynamoDB.
D. Enable DynamoDB Accelerator (DAX) in front of the DynamoDB table to cache the write requests.
Answer: B
Explanation: Using the Kinesis SequenceNumber as a sort key ensures that retries of the same record write to the same item, making the write idempotent (overwriting the same item) rather than creating duplicates. The AWS SDK automatically handles retries with exponential backoff, which addresses the throttling. Option A is complex and doesn't prevent duplicates if the first write partially succeeds. Option C doesn't solve the duplicate issue. DAX (Option D) is a cache for reads, not a solution for idempotent writes.
Question 2
A company is deploying a new microservice on AWS Elastic Beanstalk. The developer needs to ensure that database connection strings and API keys are not stored in the source code or the environment configuration files. What is the best solution to manage these secrets securely?
A. Store the secrets in a text file in the root of the application bundle and use .ebignore to prevent them from being committed to the source repository.
B. Use environment properties set in the Elastic Beanstalk console, which are encrypted at rest by default.
C. Store the secrets in AWS Secrets Manager and retrieve them using the aws-sdk within the application code.
D. Hardcode the secrets in the application configuration file and rely on AWS Identity and Access Management (IAM) roles to restrict access to the EC2 instances.
Answer: C
Explanation: AWS Secrets Manager is the industry best practice for storing, rotating, and managing secrets. It integrates with IAM for fine-grained access control and allows the app to fetch secrets at runtime without embedding them in code or config. Option B is incorrect because environment properties are visible in plain text to anyone with console access. Option A is insecure as the file is still deployed to the instances. Option D is a severe security anti-pattern.
Question 3
A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The Lambda function performs a CPU-intensive image processing task that takes approximately 15 minutes to complete. What is the most appropriate way to design the API endpoint for this use case?
A. Increase the Lambda function's timeout to 15 minutes and set the API Gateway integration timeout to 30 seconds, relying on the client to retry.
B. Use an asynchronous invocation pattern: the API endpoint triggers the Lambda function, returns a 202 Accepted status with a task ID, and stores the result in Amazon S3 for the client to poll.
C. Use AWS Lambda with an Application Load Balancer (ALB) as the trigger instead of API Gateway, as ALB supports longer timeouts.
D. Refactor the code to use AWS Fargate instead of Lambda, as Lambda has a hard limit of 15 minutes and cannot be extended. Looking for more detail? See AWS Developer Associate Difficulty: Where Developers Without AWS Experience Stumble.
Answer: B
Explanation: API Gateway has a hard timeout limit of 29 seconds, making synchronous processing of a 15-minute task impossible. The correct architectural pattern is to decouple the request from the processing using an asynchronous workflow (e.g., Step Functions or SQS). The client receives a task ID immediately and polls a separate endpoint (e.g., another Lambda function) or S3 for the result. Option A is incorrect due to the API Gateway timeout. Option C is wrong because ALB timeouts are also too short for this task. Option D is a valid fallback, but it's not the "most appropriate" for a serverless-first design.
Question 4
A developer is using Amazon S3 to host a static website. The developer wants to ensure that the content is encrypted at rest. What is the default encryption behavior for objects uploaded to a new S3 bucket?
A. Objects are encrypted by default using SSE-S3 (Amazon S3 managed keys).
B. Objects are encrypted by default using SSE-KMS (AWS Key Management Service).
C. Objects are not encrypted by default unless the developer explicitly enables default encryption on the bucket.
D. Objects are encrypted by default using client-side encryption.
Answer: A
Explanation: Since January 2023, Amazon S3 automatically applies server-side encryption with S3-managed keys (SSE-S3) to all new objects, regardless of the bucket's default encryption settings. Option B is incorrect because SSE-KMS is not the default; it must be explicitly configured. Option C is now outdated. Option D is incorrect because client-side encryption is a manual process.
Question 5
A developer has a CI/CD pipeline using AWS CodePipeline. The pipeline has a build stage that runs unit tests and a deploy stage that uses AWS CodeDeploy to deploy to an EC2 Auto Scaling group. The developer wants to automatically roll back the deployment if the health checks fail after the deployment is complete. What is the most efficient way to achieve this?
A. Configure the Auto Scaling group to use a lifecycle hook to terminate unhealthy instances.
B. Configure the CodeDeploy deployment group to use the Revert deployment configuration, which automatically rolls back on failure.
C. Configure the CodeDeploy deployment group's CloudWatch alarm to trigger a rollback when the HealthyHostCount metric goes below a threshold.
D. Use a Lambda function in the pipeline that polls the Elastic Load Balancer health check and manually triggers a rollback via the AWS CLI.
Answer: C
Explanation: CodeDeploy supports automatic rollbacks triggered by CloudWatch alarms. You can create an alarm on the target group's HealthyHostCount and configure the deployment group to roll back when the alarm enters the ALARM state. Option A is a lifecycle hook, not a rollback mechanism. Option B is incorrect; CodeDeploy uses deployment configurations like AllAtOnce or HalfAtATime, not a "Revert" configuration. Option D is overly complex and inefficient compared to the native alarm integration.
Question 6
A developer is using Amazon API Gateway to expose a REST API. The developer wants to implement authentication using a custom JSON Web Token (JWT) that is issued by their own identity provider. Which API Gateway feature should be used to validate the JWT without writing custom code in a Lambda authorizer?
A. AWS Identity and Access Management (IAM) authorization.
B. Amazon Cognito User Pools authorization. If this interests you, AWS Developer Associate Study Plan: 8 Weeks With Labs Every Weekend goes into more detail.
C. Lambda authorizer (formerly known as a custom authorizer).
D. API Gateway's native JWT authorizer.
Answer: D
Explanation: API Gateway supports a native JWT authorizer that can validate JWTs from a specified issuer and audience without requiring a Lambda function. The developer can configure the issuer URI (e.g., https://your-idp.example.com) and the audience. Option A is for AWS credentials. Option B is for Cognito, not a custom IdP. Option C (Lambda authorizer) works but requires writing and maintaining code, making it less efficient than the native JWT authorizer.
Question 7
A developer is building an application that uses Amazon DynamoDB. The application is experiencing high read latency during peak hours. The developer has identified that the table is read-heavy and the data is accessed by a specific partition key. What is the most cost-effective way to reduce read latency for this workload?
A. Switch the table to PAY_PER_REQUEST capacity mode.
B. Create a global secondary index (GSI) on the partition key.
C. Enable DynamoDB Accelerator (DAX) for the table.
D. Increase the read capacity units (RCUs) to a higher fixed number.
Answer: C
Explanation: DAX is an in-memory cache specifically designed for DynamoDB. It reduces read latency from single-digit milliseconds to microseconds, and it is cost-effective for read-heavy workloads where the same items are read frequently. Option A (on-demand) handles scaling but doesn't reduce latency. Option B (GSI) doesn't help if you are already querying by the primary partition key. Option D increases cost without addressing the underlying latency issue caused by disk reads.
Question 8
A developer is deploying a containerized application to Amazon ECS using the Fargate launch type. The application needs to access an Amazon S3 bucket. What is the most secure way to grant the application permissions to access the S3 bucket?
A. Hardcode the AWS access key ID and secret access key in the container's environment variables.
B. Store the credentials in AWS Secrets Manager and retrieve them at container startup.
C. Create an IAM role for the task and attach an IAM policy that allows s3:GetObject on the specific bucket.
D. Create an IAM user and attach the AmazonS3ReadOnlyAccess managed policy, then store the credentials in the task definition.
Answer: C
Explanation: The best practice for granting permissions to AWS resources in ECS is to use an IAM task role. This is a feature of ECS that automatically provides temporary credentials to the container via the instance metadata service (for EC2) or the task metadata endpoint (for Fargate). This avoids long-lived credentials entirely. Options A and D involve managing long-term access keys, which is insecure. Option B is better than A/D but still requires the application to manage secret retrieval, whereas the task role is seamless and automatic.
These questions represent the core logic of the DVA-C02 exam: choosing the most secure, scalable, and operationally efficient solution. The exam heavily penalizes over-engineering and insecure practices like hardcoding credentials. Remember to always prioritize managed services (like Secrets Manager, DAX, and native JWT authorizers) over custom code when they fit the requirement.
When you want to see which topic areas need more attention, take the free AWS Certified Developer - Associate readiness check for a quick sense of your weak spots.
Invest a few hours in AWS Certified Developer - Associate exam questions now and save yourself a retake later.
When you are ready to map out that time, use the free AWS Certified Developer - Associate study plan to get a schedule tailored to your pace.